Hunt.io Adds IOC Feed and Threat-Actor Attribution to C2 Data
Summary
Hunt.io introduced an IOC feed aggregating indicators from security publications and added potential threat-actor and campaign attribution to its C2 feed, which tracks malicious infrastructure.
Key points
- The IOC Hunter Feed aggregates indicators from open-source reports and research, with publication details and threat-actor metadata.
- The C2 Feed adds potential attribution connecting detected servers to known threat actors and malware campaigns.
- C2 monitoring uses protocol, certificate, and JARM/JA4 fingerprint scans, including scans of bulletproof hosting providers; Hunt.io says it applies validation logic and regular research-team updates.
- Feed entries can include IPs, hostnames, ports, timestamps, malware details, attribution, and confidence scores.
- The article demonstrates pivoting from an XCSSET C2 domain to two additional IPs through shared infrastructure and SSH-key links.
- Hunt.io says the feeds cover C2 servers, reconnaissance tools, phishing, and other malicious infrastructure observed in the past seven days, and are available to its users.
Article Details
- Event Type
- Launch of the IOC Hunter Feed and an attribution feature for Hunt.io's C2 Feed
- Impact
- Hunt.io users can access aggregated threat indicators and potential attribution linking detected C2 servers to known threat actors and malware. The article says the feeds cover recent malicious infrastructure and are intended to help defenders investigate related infrastructure and strengthen detection and incident response.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | api[.]inmediavault[.]com | Hostname identified in the enriched C2 Feed example for Cobalt Strike. |
| IPV4 | 178[.]208[.]92[.]187 | Additional IP address found by pivoting on the SSH key hash associated with the XCSSET infrastructure. |
| IPV4 | 95[.]142[.]38[.]107 | IP address described as the initial XCSSET C2 server. |
| IPV4 | 95[.]142[.]38[.]79 | Additional IP address linked to the XCSSET C2 infrastructure through shared SSH keys. |
| SHA256 | 3fe88378d4ebdd3f27063d41da0d4e69a0d3aab549aea28a0b8cd73dd9606891 | SSH key SHA-256 hash used to pivot to additional infrastructure associated with the XCSSET C2. |
| SHA256 | d9e52663715902e9ec51a7dd2fea5241c9714976e9541c02df66d1a42a3a7d2a | SHA-256 indicator listed in the IOC Hunter Feed example alongside a Shamoon malware report. |
| URL | hxxp[:]//api[.]inmediavault[.]com/PEoX | Specific scan URI listed in the enriched C2 Feed example for a Cobalt Strike C2 server. |
Threat Actors
Malware
Cobalt Strike"malware_name": "Cobalt Strike",GhostSocksTracking GhostSocks ProxiesLummaC2GhostSocks, a Golang-based SOCKS5 proxy, is sold as malware-as-a-service (MaaS) and integrated with Cobalt Strike, LummaC2, and Zloader.Shamoon"publication_title": "Shamoon Malware. Shamoon Malware is a wiper that spread...",XCSSETExpanding on XCSSET InfrastructureZloaderGhostSocks, a Golang-based SOCKS5 proxy, is sold as malware-as-a-service (MaaS) and integrated with Cobalt Strike, LummaC2, and Zloader.
Vendors
Products
C2 Feedwhy Hunt.io is introducing two powerful updates: IOC Hunter Feed and IOC Hunter Attribution in our C2 Feed.IOC Hunter Attributionto stay ahead. That's why Hunt.io is introducing two powerful updates: IOC Hunter Feed and IOC Hunter Attribution in our C2 Feed.IOC Hunter Feedneed enriched intelligence to stay ahead. That's why Hunt.io is introducing two powerful updates: IOC Hunter Feed and IOC Hunter Attribution in our C2 Feed.