Blog

Threat Hunting Blog

Threat Hunting Blog

Threat Hunting Blog

Check out our latest threat hunting articles, tips and stories

Check out our latest threat hunting articles, tips and stories

Check out our latest threat hunting articles, tips and stories

Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Feb 27, 2025

Discover Joker malware infrastructure with Hunt SSL History, mapping its C2 network through certificate tracking of recent and past activity.

LightSpy Malware Now Targets Facebook & Instagram Data
Feb 20, 2025

A new LightSpy server expands its attack scope, targeting Facebook and Instagram database files. Explore its evolving capabilities and infrastructure.

Backdoored Installers for Signal, Line, and Gmail Target Chinese-Speaking Users
Feb 18, 2025

Read how attackers distribute backdoored Signal, Line, and Gmail installers through fraudulent download pages and how to defend against this campaign.

Advanced Threat Hunting with New SSL Features: Unlocking HuntSQL™ Anomaly Flags for Deeper Detection
Feb 13, 2025

Hunt.io enhances SSL threat hunting with new anomaly flags in HuntSQL™, improving the detection of misconfigurations, expired certificates, and malware infrastructure.

Tracking Pyramid C2: Identifying Post-Exploitation Servers in Hunt
Feb 12, 2025

Discover how Pyramid, an open-source tool, enables post-exploitation. Learn detection methods using HTTP headers and recent findings in Hunt.

SmokeLoader Malware Targets Ukraine’s Auto & Banking Sectors via Open Directories
Feb 6, 2025

Attackers used open directories to spread SmokeLoader malware, luring Ukraine’s auto and banking sectors. Explore findings, execution, and tactics.

GreenSpot APT Targets 163.com Users with Fake Download Pages & Spoofed Domains
Feb 4, 2025

GreenSpot APT targets 163.com users via fake download pages and domain spoofing. Learn their tactics, risks, and how to protect your email accounts.

Unlock SSL Intelligence: How SSL History Boosts Threat Hunting
Jan 30, 2025

Explore how SSL intelligence and SSL history empower proactive threat hunting. Learn tools, real-world examples, and strategies to track cyber threats.

Unmasking SparkRAT: Detection & macOS Campaign Insights
Jan 28, 2025

Explore SparkRAT detection tactics, macOS targeting, and insights into recent DPRK-linked campaigns with actionable research findings.

1

of

9

Next

Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Feb 27, 2025

Discover Joker malware infrastructure with Hunt SSL History, mapping its C2 network through certificate tracking of recent and past activity.

LightSpy Malware Now Targets Facebook & Instagram Data
Feb 20, 2025

A new LightSpy server expands its attack scope, targeting Facebook and Instagram database files. Explore its evolving capabilities and infrastructure.

Backdoored Installers for Signal, Line, and Gmail Target Chinese-Speaking Users
Feb 18, 2025

Read how attackers distribute backdoored Signal, Line, and Gmail installers through fraudulent download pages and how to defend against this campaign.

Advanced Threat Hunting with New SSL Features: Unlocking HuntSQL™ Anomaly Flags for Deeper Detection
Feb 13, 2025

Hunt.io enhances SSL threat hunting with new anomaly flags in HuntSQL™, improving the detection of misconfigurations, expired certificates, and malware infrastructure.

Tracking Pyramid C2: Identifying Post-Exploitation Servers in Hunt
Feb 12, 2025

Discover how Pyramid, an open-source tool, enables post-exploitation. Learn detection methods using HTTP headers and recent findings in Hunt.

SmokeLoader Malware Targets Ukraine’s Auto & Banking Sectors via Open Directories
Feb 6, 2025

Attackers used open directories to spread SmokeLoader malware, luring Ukraine’s auto and banking sectors. Explore findings, execution, and tactics.

1

of

13

Next

Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Feb 27, 2025

Discover Joker malware infrastructure with Hunt SSL History, mapping its C2 network through certificate tracking of recent and past activity.

LightSpy Malware Now Targets Facebook & Instagram Data
Feb 20, 2025

A new LightSpy server expands its attack scope, targeting Facebook and Instagram database files. Explore its evolving capabilities and infrastructure.

Backdoored Installers for Signal, Line, and Gmail Target Chinese-Speaking Users
Feb 18, 2025

Read how attackers distribute backdoored Signal, Line, and Gmail installers through fraudulent download pages and how to defend against this campaign.

Advanced Threat Hunting with New SSL Features: Unlocking HuntSQL™ Anomaly Flags for Deeper Detection
Feb 13, 2025

Hunt.io enhances SSL threat hunting with new anomaly flags in HuntSQL™, improving the detection of misconfigurations, expired certificates, and malware infrastructure.

1

of

19

Next