We find exposed attacker infrastructure, read what they leave behind, and publish it as a case file.
Joined July 2026
- Tweets44
- Following0
- Followers187
- Likes5
Pinned Tweet
Coruna iOS exploit kit, new IOCs:
- 88 lure hosts
- 37 compromised sites used as watering holes
New IOCs (1/3):
iphone[.]apiforx[.]work
trigger[.]translatevv[.]com
mobilecare[.]me
carolineschaay[.]nl
IOCs below. Full list + CSV: c2huntersresearch.com/blog/2…
#Coruna #iossecurity
Your smart TV could be an attacker's exit node right now, and you'd never know.
We analysed 100+ attacker IPs renting real home internet to look like ordinary visitors. Ten real cases, from the attacker's own code.
c2huntersresearch.com/blog/2…
#ResidentialProxy #JA4 #Fraud #BOT
1
4
437
Inside the ten cases: fake signups that pass fraud checks, a bank intrusion on one proxy account across 80 scripts, cryptojacking that hides from the proxy provider too, carding, credential stuffing, and more.
The IP alone won't catch any of it.
#ResidentialProxy #JA4+
1
143
An AI agent ran a 32-day #ransomware and intrusion campaign from a single markdown file (OPERATION_MEMORY.md).
We analysed the file behind what we call Operation HADES: 2,148 lines of rules, credentials and a live log.
c2huntersresearch.com/blog/2…
#HadesRansomware #DFIR #CTI
Pivoted further using @modat_magnify and found 16 active VShell panels across 13 IPs. All serving the same Chinese-language login page.
IOC thread 🧵
#ThreatIntel #C2 #VShell
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: haiwoi.top
#ThreatIntel #C2 #VShell
We identified an exposed server hosting infrastructure for a suspected #DarkSword iOS exploit operation.
The exposed files included a SQLite database (darksword.db), exploit delivery code, post-exploitation scripts and server logs.
Here's what we uncovered:
🧵(1/4)
The recovered database contained:
• 18,054 HTTP activity logs
• 3,109 exploit telemetry records
• 5 landing-template records
• 8 configured command scripts
• 469 administrative audit events
The data provides a glimpse into the backend infrastructure.
#iOS (2/4)
1
277
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: haiwoi.top
#ThreatIntel #C2 #VShell
Coruna iOS exploit kit — new IOCs, part 2.
Additional infra found via @modat_magnify
New IOCs (1/2):
https://fcsvip[.]icu
https://btvm888[.]xyz
18[.]141[.]188[.]98
203[.]189[.]235[.]62
186[.]244[.]241[.]222
205[.]234[.]170[.]172
177[.]5[.]75[.]142
154.219[.]112[.]16
#coruna
Coruna iOS exploit kit, new IOCs:
- 88 lure hosts
- 37 compromised sites used as watering holes
New IOCs (1/3):
iphone[.]apiforx[.]work
trigger[.]translatevv[.]com
mobilecare[.]me
carolineschaay[.]nl
IOCs below. Full list + CSV: c2huntersresearch.com/blog/2…
#Coruna #iossecurity
This is what a watering-hole injection for the Coruna iOS exploit kit looks like in a site's HTML: two hidden 1x1 iframes, identical on every compromised site we checked.
Hunt for both hostnames in your page source and proxy logs.
IOCs: c2huntersresearch.com/blog/2…
#Coruna
Found new cluster infrastructure tied to this campaign.
New IOCs:
ccc[.]rangwodf[.]cc chbcnyxxd3[.]u9018[.]xyz
/qqtime.html staging path
Full IOCs: c2huntersresearch.com/blog/2…
Coruna exploit kit is targeting iOS.
Coruna leverages 23 exploits against Apple devices running iOS 13-17.2.1. It is being used for espionage, and by financially motivated actors to steal crypto.
Update your iOS devices, and learn more about this threat: bit.ly/4rbeltc
159
We have identified 42 hosts serving the Coruna iOS exploit kit, plus 26 legitimate sites that appear compromised and carry the hidden iframe.
IOCs:
ccc[.]rangwodf[.]cc
js[.]apiforxwork[.]net
1x8gmjbdq3tepgr[.]icu
Full list: c2huntersresearch.com/blog/2…
#Coruna #iOS #CTI #exploit
1/2 During recent research, we observed a threat actor run VMkatz on compromised ESXi hosts.
The tool read Windows VMDKs directly from raw VMFS devices and extracted SAM hashes, LSA secrets and cached domain credentials—without running inside the guest VMs.
#Ransomware #ESXi
2/2 Observed chain:
Staging host → privileged SSH → ESXi → /tmp/vmkatz → raw VMFS/VMDKs → credentials returned over SSH.
Hunt for:
• Unexpected ESXi SSH
• /tmp/vmkatz
• --vmfs-list, --vmfs-device, --vmdk
• Access to /dev/disks/naa*
• execInstalledOnly changes
#ESXi
2
151
One server. Five live operations: an iOS exploit kit, web exploitation, two network intrusions, a gambling SEO network, and an active vulnerability-research lab — all traced to a single host.
Full breakdown: c2huntersresearch.com/blog/2…
#Coruna #iOS #ThreatIntel #CVE #iOSExploit
@googlecloud's Threat Intelligence Group disclosed the Coruna iOS WebKit exploit kit in March 2026. We traced a separate instance active since May — the full 3-stage browser exploit chain fired against a real iPhone and completed in 6 seconds.
#Coruna #iOSExploit #ThreatIntel
3
3
298
We're seeing attackers scan for and exploit CVE-2026-58138, a critical flaw in Orkes/OSS Conductor that needs no login to abuse.
One tool we analysed scans hundreds of servers, breaks in as root, then hunts for passwords, internal network layout and running processes.
What to look for:
• POSTs to /api/metadata/workflow
• New workflows containing "INLINE" tasks
• Conductor spawning shell or system commands
Affected: 3.21.21–3.30.1
Fix: upgrade to 3.30.2
#ThreatIntel #CVE202658138 #OrkesConductor
1
81
We found an attacker's FortiGate toolkit sitting in a public directory.
Exploit tool. Implant source code. Stolen configs from compromised firewalls. And the operator's own working notes.
We read all of it and wrote up what they actually did.
c2huntersresearch.com/blog/2…
