Demon

New #threatintel research using @Huntio 🔥

Two exposed #opendir revealed targeting #Vietnamese & #Pakistani government/military infrastructure, NDU, #Mexican systems, and self-hosted #LLM gateways.

Link: infrahunter.com/research/two-o…

🚨#opendir from @Huntio at 31.77.229[.]26:80 with #PentAGI running and route through test-api[.claude[.gg using a letum-max model to target rbxcrate[.com.

#Attacks: Cloudflare bypass, SSRF, payment webhooks, IDOR, race conditions, CVE-2026-111497 as a Brotli probe hypothesis.

New Investigation on Palo Alto #Exploitation

@Huntio AttackCapture™ caught a fully operational exploitation #toolkit at 130.94.67[.]235:8080. Inside: a 4-stage #exploit chain (#PHP memory corruption → #Fragnesia kernel LPE) that achieves root on #Palo #Alto firewalls.

New Blog on #ARTEX from @Huntio

#Pivoted from the known console host 38.244.50[.]120 to a second #opendir at 23.248.226[.]250 — a Hong Kong jump server exposing .secrets files, reverse SSH tunnels, Claude Code + DeepSeek/GLM/Grok routing shims, and a staged JNDI/LDAP #RCE chain.

New #threatintel research using @Huntio 🔥

An exposed #opendir on 193.29.104[.]84:8099 leaked 48 files from what looks like an active #APT #DONOT operation targeting #Pakistan’s nuclear and energy sectors.

Full breakdown:
infrahunter.com/research/open-…