🔸 45[.]137[.]70[.]27:8080 #opendir 🔎
→ CVE-2026-24061 (Telnetd Auth Bypass)
→ CVE-2024-3721 (TBK DVR Command Injection)
→ CVE-2024-10443 (Synology RCE via Crontabj3
20
83
6.7K
Search
Caught even earlier using AdaptixC2 and this PoC for the EPMM vuln: github.com/MehdiLeDeaut/C…
The ability to pivot between @Huntio & @DefusedCyber can result in some pretty interesting findings
#opendir
Catched in the wild 😉
cc@DefusedCyberA
3
7
26
9.3K
#ThreatHunting | #Opendir | @Huntio
Pivot on hashes of VmManagedSetup.exe and z.bat uncovered 7 additional #opendir:
Timeline spans 2023 → 2026.
Same toolkit. Same directory structure. Reused infra left exposed.
IoCs: pastebin.com/QLJ8nUEH
Ref: x.com/Huntio/status/…
We found an open directory on Proton66 that a TheGentlemen ransomware affiliate forgot to close 🕵️
We pivoted on TheGentlemen ransomware IOCs and landed on an open directory on Proton66 with 126 files inside.
Full pre-encryption toolkit. Mimikatz logs with victim NTLM hashes.kens. All sitting unauthenticated on a Russian bulletproof host.
No custom malware. No zero-days. Just dual-use and off-the-shelf offensive tools in the right sequence, which is exactly why this is hard to catch.
Full breakdown, IOCs, and detection guidance:hunt.io/blog/thegentle…e
#ThreatHunting #Ransomware #ThreatIntelligence #DFIR #BlueTeam #TheGentlemen
1
6
18
1.6K
#Opendir #Malware #Loader #Injector
1🧵Summary ⤵️
1⃣WSH loads remote script from WebDAV
2⃣Script drops and runs final.bat hidden
3⃣final.bat downloads embedded Python 3.11.8 frompython.orgW
4⃣final.bat installs psutil, cryptography, pyaes
From python.org
hxxps://move-friendly-international-observed.trycloudflare(.)com/
#opendir
1
3
12
1.6K
♦️ Exposed #opendir on 187.77.173[.]118 port 8080 hosting AI-generated tools to analyze CVE-2025-6218 and test bypass variants against the official patch for WinRAR(?).
The environment includes progress tracking and references to a business model aligned with 0-day development iple .bin files and "loaders" flagged as possible Meterpreter.
[+]bazaar.abuse.ch/sample/3404b9e…V
/ @malwrhunterteam @HackingLZ @UK_Daniel_Card
1
18
102
15.8K
2
6
462
Why does this Russian support technician want to disable my antivirus?
Well, I'll leave it at that.
telegram bot token: 8617483102:AAGkFE-x8Z81Ex-PtnzkMURy1-1CI3KGpdU
$CHAT_ID = "-5185728008"
bazaar.abuse.ch/sample/d756d1e…
#opendir
3
7
50
4K
1
491
1
2
200
2
10
1K
