Hunt.io 2.1 Adds Threat-Hunting, IOC Enrichment and Infrastructure Analysis Updates
Summary
Hunt.io 2.1 adds threat-data analysis, IOC enrichment, threat-actor aliases, infrastructure pivots and platform updates. The company also says it fixed a protocol mismatch that had caused about 400,000 daily collections to fail.
Key points
- AttackCapture now automatically tags items such as exploits, target paths, domains and tools, and adds file summaries and directory statistics.
- Threat-actor profiles now include vendor aliases, linked infrastructure, related reports and filtering options.
- IP and certificate analysis gains consolidated history views, additional fingerprint and issuer data, and pivots to related infrastructure.
- The IOC Hunter feed adds malware names and descriptions, and the Cyware integration now supports the feed.
- A new dataset lists filenames and metadata from exposed open directories, including files not downloaded by AttackCapture.
- Hunt.io says a protocol mismatch that caused about 400,000 collections per day to fail was fixed on May 19.
Article Details
- Event Type
- Hunt.io product update introducing threat-hunting, enrichment, search, and integration improvements.
- Impact
- The update adds threat-actor alias and infrastructure context, file analysis and tagging, and investigation features. Hunt.io also fixed a session-timeout issue affecting some users and a protocol mismatch that had caused around 400,000 collections per day to fail; the collection issue was fixed on May 19.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | d9e52663715902e9ec51a7dd2fea5241c9714976e9541c02df66d1a42a3a7d2a | Sample SHA-256 IOC shown in the IOC Hunter feed example, alongside an APT33 threat-actor record and a description of Shamoon. |
Threat Actors
AlphVMNamed as a ransomware group in an example of threat-actor profiles.APT28Threat-actor example mapped to the aliases Fancy Bear, Forest Blizzard, and ITG05.APT33Named in the sample IOC Hunter feed record as its threat actor.Fancy BearListed as an alias for APT28, attributed to CrowdStrike.RansomHubNamed as a ransomware group in an example of threat-actor profiles.RoyalNamed as a ransomware group in an example of threat-actor profiles.
Malware
RedLine StealerThe following screenshot shows an example tied to RedLine Stealer, helping uncover infrastructure used for payload delivery or staging.Shamoon"description": "The post discusses Shamoon malware, a wiper that targets devices on a shared network to erase operating systems. It details four waves of attacks since its emergence on August 15, 2012, primarily against
Vendors
CrowdStrikeFor example, APT28 is mapped to aliases like Fancy Bear (CrowdStrike), Forest Blizzard (Microsoft), and ITG05 (IBM), so you don't miss context just because the name changed.CywareIntegrations Cyware integration updated with IOC Hunter.IBMFor example, APT28 is mapped to aliases like Fancy Bear (CrowdStrike), Forest Blizzard (Microsoft), and ITG05 (IBM), so you don't miss context just because the name changed.MicrosoftFor example, APT28 is mapped to aliases like Fancy Bear (CrowdStrike), Forest Blizzard (Microsoft), and ITG05 (IBM), so you don't miss context just because the name changed.
Products
AttackCaptureHunt.ioWe're excited to announce Hunt 2.1, a new set of upgrades across Hunt.io, all built to help you cut through the noise and focus on what matters: identifying real threats faster. From smarter AI file analysis to moreHuntSQLIOC HunterUpdated Bulk Enrichment Improved IP Enrichment to show historical C2, Attack Capture data and IOC Hunter enrichments.