Introduction: Exposed Infrastructure Reveals a More Complex AI-Assisted Cyber Operation A cybersecurity investigation by Hunt.io has uncovered a collection of exposed directories and operational tools associated with infrastructure linked to ARTEX, an AI-driven autonomous penetration-testing framework previously connected to reported cyber intrusions targeting South Korean organizations. The investigation reveals an extensive technical environment involving AI model routing, automated reconnaissance, proxy infrastructure, remote-access mechanisms, Linux exploitation utilities, and staged Java-based exploitation components.

Introduction: PHP2Shell Campaign Reveals a More Extensive Exploitation Infrastructure The ongoing PHP2Shell exploitation campaign is becoming increasingly concerning as security researchers uncover more details about the tools, infrastructure, and operational techniques used by attackers. New findings from Hunt.io reveal that researchers mapped 616 PHP2Shell-related files, providing additional visibility into the exploit ecosystem, associated tooling, and operator activity. Meanwhile, Dream Research reported that attackers used PHP2Shell alongside the Fragnesia vulnerability to obtain root access to 25 PAN-OS servers.

At a glance Malware family Custom PaperCut exploit kit, Rust credential collectors, chisel-based reverse SOCKS5 tunnels Threat actor Unnamed; suspected Russian-speaking operator using AI coding agents Targets Internet-facing PaperCut NG/MF servers, many in education; 440+ instances compromised per GreyNoise and Blackpoint Cyber Delivery vector CVE-2026-81578 and CVE-2026-82078, plus a weakly protected XML-RPC API Key capabilities

This is part two of a video series about gamifying cybersecurity inside Minecraft. The project involves using AI to create a Minecraft mod that can explore open directories on the internet. In the previous video, a sandbox world was created and the mod was connected to the hunt.io API. During this livestream session, the creator attempted to integrate the hunt.io capability into the Minecraft game environment with help from their live stream chat. After two and a half hours of streaming, minimal progress was made beyond setting up a super flat world in Minecraft. The creator acknowledges not knowing how to play Minecraft, which contributed to the limited progress during the session.

Researchers uncovered CameraSwarm, a 35-day campaign that compromised more than 14,500 Dahua IP cameras, mainly in Ukraine and Russia, using brute-force logins, vulnerability exploits, and offline recovery codes. Hunt.io traced the operation after finding exposed attacker files, and Dahua camera owners are urged to check for the persistent p2pwn account and apply firmware fixes. #CameraSwarm #Dahua #Huntio #CVE-2021-33044 #CVE-2021-33045

A threat actor allegedly used the open-source Hermes AI agent in unattended YOLO mode to automate post-exploitation tasks during an intrusion tied to Thailand’s Ministry of Finance. Hunt.io and Bob Diachenko found exposed directories with web shells, stolen credentials, and logs showing Hermes was used for privilege escalation, enumeration, and internal system traversal. #Hermes #ThailandMinistryofFinance #Huntio #BobDiachenko #Hades

Introduction: In the cat-and-mouse game of cyber threat intelligence, a single IP address, domain, or file hash is rarely the full story—it is merely a doorway. Traditional indicator-of-compromise (IOC) enrichment stops at the lookup, leaving analysts to manually piece together fragmented data across multiple platforms. Hunt.io 3.0 fundamentally shifts this paradigm by transforming simple indicators into investigation-ready intelligence, delivering full infrastructure context from a single pivot point within one unified platform.