xHunt

xHunt is a Kuwait-focused cyber-espionage threat actor active since at least 2018. The group is known for persistent, multi-year intrusions against Kuwaiti government, shipping, and transportation organizations, and for operating a custom malware ecosystem whose components are frequently named after characters from the anime Hunter x Hunter. Reported aliases include SectorD01, Hive0081, Cobalt Katana, and Hunter Serpens. The actor has used a diverse toolset that includes Sakabota, Hisoka, Killua, Gon, EYE, CASHY200, Snugy, TriFive, Netero, and the BumbleBee web shell. Its malware supports multiple covert command-and-control channels, including HTTP, DNS tunneling, and abuse of Microsoft Exchange Web Services to exchange commands and results through draft messages in compromised mailboxes. Hisoka and TriFive are notable for mailbox-draft-based C2, while CASHY200 and its Snugy variant use DNS tunneling. xHunt has demonstrated several initial access and credential collection approaches. These include targeted delivery of malicious documents, compromise of web-facing Microsoft Exchange and IIS infrastructure, and a watering-hole operation on a Kuwaiti government website that attempted to coerce visiting Windows systems into NTLM authentication to attacker-controlled SMB resources in order to capture account information and password hashes. The group has also shown interest in email credential theft through DNS redirect activity affecting mail-related services. Post-compromise, xHunt has deployed custom backdoors and web shells, executed remote commands, performed internal network discovery and port scanning, transferred tools over SMB, and established persistence through scheduled tasks designed to resemble legitimate Windows tasks. Associated tooling has supported screenshot capture, file upload and download, remote command execution, and creation of RDP sessions. Reporting also links the actor to credential theft from LSASS, changes intended to enable WDigest plaintext credential storage, and use of SSH tunneling for access to internal services and lateral movement. The group consistently emphasizes stealth and defense evasion. Observed tradecraft includes scheduled-task masquerading, use of trusted directories and legitimate accounts, covert C2 over enterprise email and DNS, cleanup tooling to remove attacker artifacts, and operational measures intended to complicate attribution and tracking. Overall, xHunt is best characterized as a sophisticated, narrowly focused espionage actor centered on long-term access and intelligence collection in Kuwait.