Loading story…
Researchers found the xHunt threat actor using a newly identified ASPX webshell called BumbleBee on a compromised Microsoft Exchange server and several internal IIS servers at organizations in Kuwait. The webshell supported command execution and file upload and download, and was used alongside account and network discovery activity to expand access inside victim environments. Investigators said the actor also monitored compromised Outlook Web App mailboxes, including helpdesk and security alert accounts, to track defensive responses and maintain persistence.
The intrusions also involved Plink-based SSH tunnels that gave the actor access to internal systems over RDP and HTTP, enabling lateral movement while limiting exposure of direct attacker infrastructure. Unit 42 linked the activity to earlier xHunt operations through reused SSH credentials from the Sakabota cheat sheet and overlapping infrastructure, including 192.119.110[.]194, 142.11.211[.]79, 91.92.109[.]59, and domains associated with backendloop[.]online. The actor further obscured operations by routing traffic through Private Internet Access VPN nodes and, in some cases, FalcoVPN, rotating source IP addresses across multiple European countries while maintaining long-term access to Kuwaiti targets.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Investigators connected the BumbleBee intrusions to the previously reported xHunt campaign through reused SSH credentials from the Sakabota cheat sheet and overlapping infrastructure, including IP addresses and backendloop[.]online-related domains. They also observed the actor masking operations with rotating VPN infrastructure and monitoring compromised Outlook Web App mailboxes for helpdesk and security alerts.
During the intrusions, the actor conducted network and account discovery, moved laterally, and created SSH tunnels with Plink to reach internal systems over RDP and HTTP. The activity showed sustained internal access and operational use of compromised servers to pivot deeper into victim networks.
Unit 42 found that the xHunt threat actor deployed a previously unreported ASPX webshell called BumbleBee on a compromised Microsoft Exchange server and multiple internal IIS servers at organizations in Kuwait. The webshell supported command execution and file upload/download and was used to maintain access inside victim environments.
At a Kuwaiti organization, xHunt had compromised a Microsoft Exchange server by at least 2019-08 and maintained access with scheduled tasks, the BumbleBee web shell, the newly identified TriFive PowerShell backdoor, and a Snugy/CASHY200 variant. Researchers observed command execution and data exfiltration from the server and linked the activity to prior xHunt infrastructure.
Unit 42 observed the first known 2019 xHunt attack against a Kuwaiti transportation and shipping organization, where attackers installed the Hisoka backdoor and, within hours, deployed the Gon and EYE post-exploitation tools. The activity marked the use of previously unknown custom malware later associated with the xHunt campaign.
Unit 42 found that Sakabota developers conducted iterative testing of multiple malware variants and obfuscation methods in July and August 2018 using online antivirus scanning services. The testing progressed from Sakabota version 1.4.0.0 to 1.6.0.0 and identified a .NET Reactor build as producing the lowest detection rate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 126 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that the **xHunt** campaign deployed **CASHY200**, a PowerShell-based backdoor that used **DNS tunneling** for command-and-control and data exfiltration against organizations in Kuwait, including government entities. The malware communicated through DNS `A` queries and responses to infrastructure including `windows64x[.]com`, encoding commands and stolen data in subdomains with sequence numbers and command values such as `48`, `92`, and in older variants `200`. Investigators linked the activity to earlier xHunt infrastructure associated with **Sakabota** C2 operations and said the campaign ran from spring 2018 through 2019. Delivery methods included malicious Word documents and executable droppers using lures themed around Kuwait government organizations, and Unit 42 said a Kuwait-based victim’s malicious DNS tunneling traffic was blocked by DNS Security in September 2019, cutting off the attackers’ access to compromised systems.
Aug 14, 2026
Researchers linked a cluster of hacktivist activity with medium confidence to **4BID** and associated groups including **Hakerskii Kit**, **C.A.S.**, and **Goffee**, reporting that operations have expanded beyond Russia and Belarus into **Kazakhstan, the UAE, Syria, and Egypt**. The attackers primarily obtained initial access by exploiting **ProxyShell** on vulnerable **Microsoft Exchange** servers, then installed the `fd.aspx` web shell and used custom scripts alongside legitimate remote management and monitoring tools to deepen access and persistence. Post-compromise activity included deployment of **BlackReaperRAT**, **Warp RAT**, **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, and a newly documented **BlackSalt** backdoor, as well as utilities such as **AnyDesk**, **Panorama9**, **Dev Tunnels**, **Tactical RMM**, and **Nezha Monitoring**. Investigators also observed **EDR killers**, **ClearWater ransomware**, and an updated **Blackout Locker** variant, indicating that the campaigns have evolved from primarily politically motivated disruption into broader operations with a stronger **financially motivated** component.
Jul 1, 2026
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026