Tool
Hunt
- First Reported
- Oct 24, 2024
- Latest Reported
- Jan 23, 2025
Reported Context (4)
- above. which listed 39 IPs associated with the GhostWolf infrastructure. We queried each IP in the Hunt app to identify commonalities that would aid in tracking more recent servers. One key data point surfaced TLS Certificate and JA4X Clues Link New Servers to Suspected GhostWolf Infrastructure
- Using Hunt to analyze these IPs, we determined both servers are hosted on The Constant Company, LLC network, with geolocations in the United States. Additionally, the "Domains" tab within Hunt's overview page surfaced TLS Certificate Analysis Links Cyberhaven Extension Attack to Long-Running Infrastructure
- Hunt researchers recently uncovered evidence of a suspected North Korean-linked phishing campaign targeting Naver, a major South Korean tech platform. The initial discovery involved an open directory containing phishing Researchers Link Naver Phishing Infrastructure and Apple Spoofing Domains to Suspected DPRK Activity
- shared SSH keys, suggesting a connection to our original server. This relationship was uncovered using the Hunt's Association tab, as shown in Figure 6. Rekoobe Backdoor Found on Open Servers Alongside TradingView Lookalike Domains
Malware (2)
People (1)
Threat Actors (10)
MITRE ATT&CK (3)
Vendors (5)
Products (7)
Tools (5)
Industries (2)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.