Hunt.io Recaps 2024 Threat-Hunting Tools and Cyber Threat Research
Summary
Hunt.io reviews 2024 launches including a C2 feed, AttackCapture code search and HuntSQL, alongside research highlights on malware, phishing and attacker infrastructure.
Key points
- Hunt.io launched a near-real-time C2 feed covering more than 125 malware families.
- AttackCapture helps investigate exposed directories and malicious files, with code search for exploit code, malware and C2 configurations.
- HuntSQL lets analysts query data related to malware, phishing infrastructure, HTTP activity, certificates and honeypot observations.
- Research highlights included a Mustang Panda-attributed ToneShell campaign targeting IISS Defence Summit attendees and suspected North Korean actors using Telegram and malicious Apple Scripts.
- Other research covered ShadowPad infrastructure identified through certificate and HTTP anomalies, Xeno RAT distribution via .gg domains and GitHub, and an exposed PlugX builder and controller.
Article Details
- Event Type
- Hunt.io's 2024 product updates and threat-research highlights
- Impact
- Hunt.io introduced and updated threat-hunting products and capabilities, including C2 Feed, AttackCapture Code Search, and HuntSQL. Its highlighted research reported attacks involving ToneShell, suspected North Korean threat actors targeting blockchain and crypto communities, ShadowPad infrastructure, Xeno RAT distribution, and an exposed PlugX builder/controller.
Threat Actors
Malware
Products
AttackCaptureC2 FeedC2 FeedHuntSQLPlugXLegacy Threat: PlugX Builder/Controller Discovered in Open DirectoryShadowPadTracking ShadowPad Infrastructure Via Non-Standard CertificatesToneShellToneShell Backdoor Used to Target Attendees of the IISS Defence SummitXeno RATGood Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub