PHP2Shell Scanners Left Their Toolboxes Open, and Hunt.io Looked
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
IOCs
Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
2 stories match your filters.
PaperCut Attacker Left an AI Hacking Workbench Wide Open
Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.