Company
Threat-intelligence firm that tracks malware infrastructure and exposed devices using crawlers like AttackCapture to find attacker-controlled servers.
Hunt.io mapped five SpiceRAT command-and-control servers active in mid-March 2026 and found a certificate spoofing Uzbekistan's state railway, issued by a Chinese state-funded CA, on hosts Bitdefender had filed under two other malware families.
Reality
Hunt.io found that BraZetsu's servers had moved hosts months before Group-IB's August 31 report named them. Defenders who block only the published addresses are pointing at infrastructure the operators had already abandoned.
Reality
ThreatDown says the Carbonato worm breaks into Docker daemons open on port 2375 and installs the open-source Hermes AI agent, then rescans nearby networks every five minutes to spread. An operator drives each infected host over Telegram.
Reality
Hunt.io says one operator brute-forced its way through more than 14,000 internet-exposed cameras in five weeks. The tooling was borrowed; the exposure did the work.
Perspective Coverage
6 publishersReality
The three flaws CISA listed on August 27 include a 2023 ownCloud bypass scored at CVSS 9.8. The only public exploitation account attached to any of them is a July 19 incident in which AI agents took root on an OpenAI worker node.
Perspective Coverage
4 publishersReality
Hunt.io only found the intrusion because the operator left his staging directory browsable on port 8000 in Amsterdam. The scripts inside needed no passwords, just valid usernames and an ownCloud install nobody had updated.
Perspective Coverage
3 publishersReality
Hunt.io says a threat actor left 298 files in an open directory in Thailand, including FortiGate and F5 exploit scripts written for 3BB and a MeshCentral backdoor that the cleanup script checked was still running.
Reality
Hunt.io captured the operator's own server on June 3, 2026, while the intrusion was live. The files on it show password spraying across more than 55 internal hosts and a cleanup script written to erase everything except the MeshCentral agent.
Reality
Hunt.io crawled the operator's own open directory and found the campaign output: 250 SonicWall SMA1000 appliances scanned, 168 leaking LDAP credentials, five Active Directory databases replicated in full.
Reality
Hunt.io says a Chinese-speaking operator drove Claude Code, Alibaba Qwen and DeepSeek through an orchestration framework called SecFlow, splitting reconnaissance, exploitation and collection among specialist agents that fired only publicly documented exploits.
Reality
Hunt.io rebuilt the framework from five directories the operators left open, and found the worker roles fixed while the model profile stays a swappable setting, with requests fronted by private proxies instead of vendor APIs.
Reality
Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.
Perspective Coverage
3 publishersReality
Hunt.io says over 14,530 cameras fell to three parallel vectors. Two are the operator's problem. The third, the vendor's own P2P relay, opens on a serial number alone.
Reality