https://hub.huntbase.io 2026-09-21T05:29:22 urn:huntbase:hunt:proxy-obscured-identity-endpoint-correlation 2026-09-21T05:29:22 Huntbase

An adversary is using multi-hop proxy infrastructure to authenticate via Okta and subsequently execute discovery commands on an endpoint, obscured by network egress to proxy relay ports.

urn:huntbase:hunt:rapid-identity-breakout-exfiltration 2026-09-21T05:26:11 Huntbase

An adversary uses a compromised privileged identity to exfiltrate data via a multi-hop proxy or tunnel within 30 minutes of initial access, moving faster than traditional telemetry export batches.

urn:huntbase:hunt:endpoint-to-cloud-phased-intrusion-hunt 2026-09-20T22:27:36 Huntbase

An adversary establishes a beachhead on an endpoint, moves laterally to obtain administrative access, and pivots to cloud services while maintaining C2 via a multi-hop proxy.

urn:huntbase:hunt:multi-hop-proxy-tor-activity 2026-09-20T21:41:51 Huntbase

An adversary is masking command-and-control traffic by routing it through multi-hop proxies, Tor entry nodes, or tunneling services to bypass perimeter monitoring.

urn:huntbase:hunt:multi-hop-proxy-identity-triage 2026-09-20T21:39:28 Huntbase

An intruder is using a multi-hop proxy or tunneling service to obfuscate C2 traffic, which can be distinguished from legitimate researcher activity by correlating network leads with user risk profiles and local port bindings.

urn:huntbase:hunt:managed-access-tenant-integrity 2026-09-20T21:36:14 Huntbase

An adversary has established persistence via cross-tenant delegated administration or unattended remote support, subsequently deploying autonomous agents that communicate through multi-hop proxies.

urn:huntbase:hunt:network-proxy-relay-obfuscation 2026-09-20T21:33:09 Huntbase

An adversary is using multi-hop proxies or Operational Relay Box (ORB) networks to disguise command-and-control traffic, which can be identified by shell processes making outbound connections to rare external IP addresses and resolving proxy-related DNS infrastructure.

urn:huntbase:hunt:vulnerable-driver-exploitation-kernel-escalation 2026-09-20T21:30:18 Huntbase

An adversary has exploited a public-facing application to stage and load a vulnerable kernel driver, bypassing security controls to gain persistent high-integrity access to the host.

urn:huntbase:hunt:cloud-workload-identity-network-triage 2026-09-20T21:23:32 Huntbase

An adversary uses over-permissioned cloud identities to compromise container workloads, establishing persistence through rare outbound network channels that bypass standard scanning.

urn:huntbase:hunt:cloud-workload-runtime-exploitation-behavior 2026-09-20T21:20:25 Huntbase

An adversary has exploited a public-facing containerized application and is maintaining persistence through binary drift or suspicious shell execution within the workload runtime.

urn:huntbase:hunt:edge-ai-artifact-integrity-exfiltration 2026-09-20T21:17:33 Huntbase

An adversary has compromised the Edge AI supply chain to poison model artifacts, then manipulated those models via prompt injection to exfiltrate sensitive weights and credentials over high-volume network channels.

urn:huntbase:hunt:appliance-persistence-identity-abuse 2026-09-20T21:15:31 Huntbase

An adversary has modified appliance scheduled tasks to disable MFA and is exfiltrating credentials via native Slack webhook integrations.

urn:huntbase:hunt:collaboration-platform-phishing-and-execution 2026-09-20T21:11:22 Huntbase

An intruder has compromised an enterprise identity using collaboration tools to bypass email-based controls and execute malicious code via sideloading or malicious dependencies.

urn:huntbase:hunt:build-time-execution-secret-harvesting 2026-09-20T20:55:30 Huntbase

An attacker has compromised a software dependency to execute malicious code during the build phase, subsequently harvesting cloud and developer credentials from the environment's configuration files.

urn:huntbase:hunt:aws-cloud-identity-takeover-chain 2026-09-20T20:52:08 Huntbase

An adversary has gained initial access to a cloud account by brute-forcing the console and performing a password reset, then used that access to establish a presence across multiple projects in the organization.

urn:huntbase:hunt:endpoint-data-staging-exfiltration 2026-09-20T20:48:23 Huntbase

An adversary has staged sensitive information in temporary directories and is exfiltrating that data via rare outbound network connections or DNS lookups.

urn:huntbase:hunt:identity-cloud-pivot-web-exploits 2026-09-20T20:46:31 Huntbase

An adversary has exploited an internet-facing web server to establish a beachhead and is now manipulating cloud or SaaS identities to persist and reconfigure the environment.

urn:huntbase:hunt:linux-fileless-in-memory-execution 2026-09-20T20:42:51 Huntbase

An adversary is executing malicious code on Linux hosts by staging payloads in memory-backed file descriptors, using interpreter one-liners, or running unlinked binaries to avoid on-disk detection.

urn:huntbase:hunt:kubernetes-service-account-abuse-and-escape 2026-09-20T20:40:13 Huntbase

An intruder has harvested a service account token from a compromised pod and is using it to deploy a privileged pod for container escape, bypassing standard runtime process detection.

urn:huntbase:hunt:ai-themed-social-engineering-multi-stage-fraud 2026-09-20T20:36:42 Huntbase

An adversary is using lookalike AI domains and installers to trick users into downloading stealers or performing device-code authentication, leading to token theft and financial fraud.

urn:huntbase:hunt:linux-ebpf-rootkit-execution-manipulation 2026-09-20T20:34:19 Huntbase

An intruder has deployed an eBPF rootkit that hides network connections and kernel objects by manipulating syscall returns and tampering with Netlink buffers.

urn:huntbase:hunt:ad-rms-discovery-recon 2026-09-20T20:32:15 Huntbase

An adversary is identifying on-premises AD RMS clusters via DNS and rights-policy template enumeration before escalating privileges via local group membership to reach the administrative surface.

urn:huntbase:hunt:multi-stage-intrusion-ransomware-triage 2026-09-20T20:28:51 Huntbase

An adversary has established a beachhead, moved laterally to host-314, exfiltrated data via Node.js to an AI service, and initiated ransomware encryption.

urn:huntbase:hunt:commodity-loader-ppi-activity 2026-09-20T20:25:26 Huntbase

An intruder is using trojanised installers to deploy a multi-stage loader that beacons to rotational C2 domains and installs follow-on backdoors like Insomnia RAT and ARKTunnel.

urn:huntbase:hunt:knight-office-token-theft-persistence 2026-09-20T20:20:49 Huntbase

An adversary has stolen Microsoft 365 session tokens via a device-code phishing flow and secured persistence by enrolling an unauthorized rogue device into the Entra ID tenant.

urn:huntbase:hunt:knight-office-delivery-redirection 2026-09-20T20:16:51 Huntbase

An adversary is using Monday.com redirects and .vu landing pages to deliver Knight Office phishing lures to M365 users.

urn:huntbase:hunt:entra-id-agent-user-impersonation-teams-abuse 2026-09-20T20:13:56 Huntbase

An attacker uses the Entra ID Agent User OAuth flow to impersonate an AI agent and dispatch malicious content via Microsoft Teams using Graph API cmdlets.

urn:huntbase:hunt:chrysalis-dll-side-loading-execution 2026-09-20T20:10:39 Huntbase

An attacker has achieved code execution by placing a malicious DLL in the same directory as a legitimate Bluetooth service, exploiting the search order to side-load code and bypass standard system directory protections.

urn:huntbase:hunt:bitb-phishing-rogue-rmm-persistence 2026-09-20T20:06:32 Huntbase

An adversary has used browser-in-the-browser phishing to deceive a user into installing a rogue ScreenConnect instance, which established service-based persistence and executed evasion tools to hide its activity.

urn:huntbase:hunt:bulk-directory-discovery-aad-graph 2026-09-20T20:01:09 Huntbase

An adversary uses legacy Azure AD Graph API endpoints and known offensive Client IDs to perform bulk directory enumeration, specifically targeting internal API versions that expose sensitive authentication methods.

urn:huntbase:hunt:errtraffic-wordpress-infrastructure-compromise 2026-09-20T19:49:33 Huntbase

An adversary has compromised a WordPress server using harvested credentials and installed a PHP backdoor or malicious plugin to facilitate the delivery of ErrTraffic ClickFix lures.

urn:huntbase:hunt:sonicwall-sma-zero-day-exploitation 2026-09-20T19:46:14 Huntbase

An adversary has exploited a pre-authentication proxy bypass and CVE-2026-15410 to execute commands on a SonicWall SMA appliance, established persistence via Nginx rewrites, and moved laterally using specific browser fingerprints.

urn:huntbase:hunt:spiffe-spire-identity-spoofing 2026-09-20T19:40:52 Huntbase

An attacker with root access on a Kubernetes node is spoofing cgroup metadata to trick the SPIRE agent into issuing identities belonging to co-located workloads for unauthorized service impersonation.

urn:huntbase:hunt:industrial-scale-ai-distillation-extraction 2026-09-20T19:37:41 Huntbase

China-based adversaries are using fraudulent accounts and proxy transfer stations to conduct high-volume, automated extraction of proprietary AI model capabilities through systematic distillation.

urn:huntbase:hunt:anomalous-cloud-identity-behavior 2026-09-20T19:34:58 Huntbase

An adversary has compromised an administrative cloud identity and is accessing the environment through multi-hop proxies or Tor to perform discovery and initial access.

urn:huntbase:hunt:public-app-exploitation-cloud-identity-drift 2026-09-20T19:31:29 Huntbase

An adversary has exploited a public-facing application on a cloud instance to obtain its identity, which is now being used for activity that deviates from the host's established behavioral profile.

urn:huntbase:hunt:wmi-lateral-movement-proxy-c2 2026-09-20T18:41:29 Huntbase

An intruder has moved laterally using WMI to execute code on internal Windows hosts and is maintaining command-and-control through multi-hop proxies or Tor to obfuscate traffic.

urn:huntbase:hunt:bypass-npm-cooldown-dependency-compromise 2026-09-20T18:38:25 Huntbase

An intruder or developer removes the npm cooldown setting to bypass a mandatory waiting period for new packages, enabling the installation of a compromised dependency.

urn:huntbase:hunt:obfuscated-identity-host-access 2026-09-20T18:36:09 Huntbase

An adversary is using multi-hop proxies or tunnels to mask their origin during authentication to cloud identity providers, subsequently using that access to reach internal hosts and execute local commands.

urn:huntbase:hunt:macsync-binary-persistence-tampering 2026-09-20T18:31:20 Huntbase

An adversary has established long-term persistence on a macOS host by installing a Mach-O RAT via a custom LaunchAgent and is using specialized capture agents to bypass TCC permissions and phish for crypto wallet recovery phrases.

urn:huntbase:hunt:macsync-scripted-execution-credential-theft 2026-09-20T18:25:21 Huntbase

An attacker has deployed MacSync Stealer on a macOS host by tricking a user into executing a curl-to-zsh one-liner, which then runs in-memory scripts to harvest credentials and keychains.

urn:huntbase:hunt:malicious-c2-infrastructure-polling 2026-09-20T18:12:43 Huntbase

An intruder is communicating with AMOS or NetSupport RAT infrastructure through DNS lookups, direct socket connections, or specific HTTP paths, often utilizing processes running from temporary directories.

urn:huntbase:hunt:cross-platform-malware-execution-persistence 2026-09-20T18:08:58 Huntbase

An intruder has compromised endpoints via a fake Google Doc lure, leading to user-driven execution of AMOS or NetSupport RAT loaders followed by persistence and credential staging.

urn:huntbase:hunt:ai-impersonation-script-execution-data-theft 2026-09-20T18:04:14 Huntbase

An intruder uses a trusted AI platform to trick a user into executing a terminal command from the clipboard, establishing persistence and stealing credentials.

urn:huntbase:hunt:ai-platform-mediated-malvertising-redirection 2026-09-20T18:00:05 Huntbase

An intruder is abusing trusted AI platforms such as Claude or ChatGPT to host malicious redirection lures via SEO poisoning, funnelling users from legitimate AI domains to secondary malware delivery infrastructure.

urn:huntbase:hunt:tampered-exodus-persistence-c2 2026-09-20T17:55:52 Huntbase

An intruder has deployed a tampered Exodus wallet that suppresses its UI and maintains persistence through a headless PowerShell scheduled task while communicating with a hardcoded C2 IP.

urn:huntbase:hunt:chaindrop-worm-persistence-propagation 2026-09-20T17:50:07 Huntbase

An adversary has compromised developer environments by injecting malicious hooks into IDE configuration files, using automated GitHub workflows to propagate an npm worm and resolve C2 via Ethereum smart contracts.

urn:huntbase:hunt:chaindrop-npm-worm-activity 2026-09-20T17:45:30 Huntbase

An intruder has infected an npm package and triggered a preinstall hook that uses the Bun runtime to harvest credentials from the filesystem and CI runner process memory.

urn:huntbase:hunt:kimwolf-blockchain-c2-ddos-impact 2026-09-20T17:41:42 Huntbase

IoT or Android devices in the environment are infected with Kimwolf v7, as indicated by a local proxy listener on port 23075 and Ethereum Name Service (ENS) resolution used to bypass traditional C2 infrastructure takedowns.

urn:huntbase:hunt:kimwolf-adb-propagation-evasion 2026-09-20T17:38:42 Huntbase

An intruder exploits unauthenticated ADB services on port 5555 to drop ELF binaries and masquerades as the netd_service system process to avoid detection on Android IoT devices.