Hunt.io Recaps 2025 Threat-Hunting Platform Updates and Research
Summary
Hunt.io reviews 2025 platform upgrades for threat investigations, its internet-scale reconnaissance figures, threat-hunting resources, and research on campaigns, malware, and malicious infrastructure.
Key points
- Hunt.io says it conducted about 660 trillion port probes in 2025, alongside billions of HTTP, protocol, HTTPS, certificate, and SSH analyses.
- Platform releases added or refined SSL certificate anomaly flags, IOC and C2 feeds, phishing workflows, IP risk context, SQL guidance, and investigation pivots.
- Hunt 2.0–2.8 updates focused on search performance, threat context, filtering, integrations, and analyst workflows.
- The company highlighted guides and query resources for discovering malicious infrastructure and conducting threat hunts.
- Featured investigations covered ClickFix activity linked to APT36, ERMAC source-code exposure, KeyPlug staging infrastructure, and MuddyWater phishing.
- Other research examined Stealc and Pyramid C2 delivery, SparkRAT activity, and Gamaredon infrastructure and ShadowPad.
Article Details
- Event Type
- Hunt.io's 2025 year-in-review covering product updates, platform capabilities, and threat research publications.
- Impact
- Hunt.io reported platform upgrades to investigation workflows, IOC and C2 analysis, infrastructure visibility, and phishing investigations. The article also recaps research into multiple campaigns and malware, but provides no specific new incident impact.
Threat Actors
Malware
ERMAC v3.0ERMAC v3.0 source code leak and infrastructure analysis: We broke down what's possible when a live Malware-as-a-Service codebase leaks, including attribution opportunities, infrastructure mapping, and ways defenders canPyramidRussian-speaking actors impersonating EFF to deliver Stealc and Pyramid C2: An exposed directory provided the campaign's working parts, from decoys to malware, and our analysis connected additional servers throughShadowPadGamaredon's flux-like infrastructure and ShadowPad activity with overlaps: This piece focused on how attacker-controlled infrastructure is configured and rotated in state-linked activity, highlighting patterns defendersSparkRATSparkRAT detection, macOS activity, and malicious connections: We covered detection-relevant traits and infrastructure signals around SparkRAT activity, including why its cross-platform design keeps it attractive inStealCRussian-speaking actors impersonating EFF to deliver Stealc and Pyramid C2: An exposed directory provided the campaign's working parts, from decoys to malware, and our analysis connected additional servers through
Vendors
FortinetKeyPlug staging server exposure tied to Fortinet exploits and webshell activity: A short-lived exposed directory revealed exploit scripts, a webshell, and recon activity aimed at portals tied to a major JapaneseHunt.ioonly exists because of what's running behind the scenes. Every investigation, pivot, and connection in Hunt.io is backed by continuous reconnaissance at internet scale. The numbers below provide a sense of the raw
Products
AttackCaptureHunt 2.0Hunt 2.0 launched with a modernized experience focused on deeper analysis, stronger performance, and more robust SQL and API workflows, alongside data improvements across threat actor, C2, and malware context.Hunt.ioonly exists because of what's running behind the scenes. Every investigation, pivot, and connection in Hunt.io is backed by continuous reconnaissance at internet scale. The numbers below provide a sense of the rawHuntSQLIOC HunterIn the same window, IOC Hunter expanded with a dedicated IOC Hunter Feed and attribution surfaced into the C2 Feed to better connect infrastructure to reports, actors, and campaigns.NetBirdAPT MuddyWater targeting CFOs with multi-stage phishing and NetBird abuse: We traced a spear-phishing campaign masquerading as a recruiter, combining CAPTCHA friction, staged scripts, and legitimate remote tooling forURLxURLx also expanded to 10.6B URLs, strengthening recon and infrastructure hunting coverage when you need to pivot from a single artifact to a broader footprint.