Hunt.io

🚨 Russian APT29 Targets iOS and Android Users Through Watering Hole Attacks

securityaffairs.com/202473/apt/rus…

The Russia-linked group APT29 (aka Cozy Bear) has been tied to a watering hole campaign targeting mobile users through compromised websites, fake domains, and a hijacked Ukrainian analytics service.

The attackers injected malicious JavaScript to collect information about visitors' devices and deliver exploit chains targeting vulnerable iOS and Android versions.

The campaign used DarkSword against iOS and AndroSnitch against Android, stealing browser cookies, credentials, messages, and other sensitive data.

All exploits targeted previously patched vulnerabilities, with no zero-days involved.

#ThreatIntel #APT29 #Android #iOS #CyberSecurity

🚩 China-Aligned SlippyNunchucks Uses DNS Hijacking to Deliver Malware

infosecurity-magazine.com/news/slippynun…

The China-aligned group SlippyNunchucks abused Sogou Input Method, a popular Chinese keyboard app, to distribute DarkVigil, a modular .NET malware toolkit with over 20 plugins.

The attack used DNS hijacking to redirect unencrypted HTTP requests to attacker-controlled servers, which delivered malicious configurations that made Sogou download and execute the malware.

Victims were identified across six countries, including Japan, Thailand, and Vietnam.

Sogou 16.10 addressed the issue by switching to HTTPS and adding certificate pinning. The exact source of the DNS hijacking remains unknown.

#ThreatIntel #DarkVigil #Malware #CyberSecurity

Three open directories on the same host, captured over five weeks. All of them pointing at one target: Tamkang University in Taiwan 🇹🇼

The operator built a custom blind SQLi framework against the university’s IP registration system at 163.13.240[.]200. Boolean oracle over SOCKS5, TRUE/FALSE detection via Chinese error strings.

The companion script enumerates information_schema, samples rows from 10 tables. The output file confirms it worked: 212 IP ranges, 170 support tickets going back to 2005, full network inventory with usernames, department codes, room numbers, phone extensions, equipment, OS types.

On a different port, the same server holds SEP14E64A.exe, a Windows RAT named to look like a Symantec installer. WSS C2 via SChannel, systeminfo beacon, file transfer with chunking and resume, process/registry/service enumeration, browser detection. Config is encoded behind a CFG! marker, not plaintext. Next to it: wisp_agent_linux, a Go binary with shell + SOCKS components supporting five transport modes including DNS.

Then the http.log on :8899. A TANet IP (163.13.121[.]218, MoE Computer Center TW) listed the directory and pulled bdgrab.exe with a 200 on Oct 11.

The server also stages credential stuffing scripts, SSH pivots via sshpass and Paramiko, MS17-010/EternalBlue targeting five Tamkang hosts, CVE-2023-46604 ActiveMQ payload builders, and FortiSIEM CVE-2025-25256 + CVE-2025-64155 PoCs.

No actor attributed.

🚨 CVE-2026-123158: OpenSSH Authentication Bypass Already Under Attack

thehackernews.com/2026/11/hacker…

CVE-2026-123158 (SSHole) is an OpenSSH authentication bypass affecting musl-based Linux systems without PAM, including Alpine Linux on default settings.

The flaw allows attackers to access accounts with disabled passwords by supplying oversized passwords (257-1,024 bytes), without valid credentials or SSH keys.

Exploitation began less than nine hours after disclosure, with confirmed root access to at least one Alpine Linux honeypot.

Eight attempts were traced to IP 89.116.89[.]18, with attackers running id, uname, and hostname.

Glibc-based distributions are not affected. OpenSSH 10.6p2 fixes the issue.

#ThreatIntel #Linux #SSH #AlpineLinux #CyberSecurity

📌 How One Exposed Directory Revealed an Attack on Ukraine's State Infrastructure

In this analysis published a couple of weeks ago, we uncovered a Russian-speaking operator targeting Ukraine's state data-exchange infrastructure. In case you missed it the first time, here's a quick recap.

The operator scanned 7,576 hosts and used a Log4Shell-based chain against Graylog servers.

We found the evidence in an exposed staging directory containing scripts, scan results, and access logs.

It was publicly accessible for 17 hours, giving us enough data to reconstruct the activity and trace the attack back to its targets.

Check out the full article here 👉 hunt.io/blog/ukraine-s…

#ThreatHunting #ThreatIntel #CyberSecurity