Establishing persistence via creation a SSH tunnel on port 80 Using @Huntio intelligence, we can see the port 80 SSH has been active since July 7th SSH-80-B28C99448F18AC8DC35214910E0BE900

More information can be found here including some source code: portal.hunt.io/attackcapture…

Case 3: A threat actor attempted to exploit Roundcube CVE-2025-49113 against Kyrgyz National Security Service (mail.gknb.gov.kg) Other known CVEs and public POCs were used by this threat actor to target Found via 89.124.123[.]216:8080 - @Huntio Link to full article 👇

Case 2: Kyrgyz Ministry of Foreign Affairs (mfa.gov.kg) web app was compromised to upload VShell and run post-exp C2 database logs revealed extensive compromise of internal network of Syrian Customs (customs.gov.sy) Found via 207.148.64[.]94:8083 @Huntio

Case 1: 🇷🇺 Ministry of Emergency Situations (EMERCOM) has previously come up in a previous Ctrl-Alt-Intel blog due to links to YUTEK-NN & Void Blizzard. In this blog they are being targeted, amongst various other Russian organisations Found via 45.151.139[.]249:8765 - @Huntio

Payloads linked to campaign have been tracked by @smica83 @skocherhan @malwrhunterteam

RMMS installed by the group included: - MeshCentral - ScreenConnect - PulseWireX

- Leverages Github to retrieve encrypted config hxxps://gist.githubusercontent[.]com/wservices66-maker/53ba3186cf8ec0cada46fc1ccb4a0ec7/raw/apiKey - Also leverages BNB blockchain to retrieve config Decrypts using string "ErjanikGaloyan$$" 🇦🇲

An alternative execution chain that began with the delivery of a .vdhx container installed a C++ variant of GaloyanRAT

Interesting reporting by FIND on a OPSEC L from Armenian-linked cargo-theft threat actors deploying "GaloyanRAT" & an assortment of RMMs 500+ payloads were exposed on cloud storage, linked to targeting of carriers 🧵