Loading story…
Hunters International was linked to two intrusion chains that show the ransomware group expanding beyond conventional Windows compromise into tailored access and virtualization-focused impact. Quorum Cyber identified a new RAT dubbed SharpRhino, assessed as related to the ThunderShell family, during a Hunters International ransomware incident in which the malware was allegedly delivered through a typosquatting site impersonating Angry IP Scanner. The RAT established persistence, enabled remote access, and used previously unseen methods to gain elevated privileges, while attribution to Hunters International was supported by observed tradecraft and the ransom note.
A separate Synacktiv investigation detailed a Hunters International attack that began with malvertising and a trojanized RVTools installer delivering the SMOKEDHAM backdoor, followed by deployment of Kickidler Grabber for surveillance and credential theft. The attackers used reverse SSH tunnels and RDP to pivot from an administrator workstation to internal servers, exfiltrated archived file shares with WinSCP, and then pushed a custom Rust-based ESXi encryptor via a PowerShell workflow using VMware PowerCLI to enable SSH, transfer the payload, and schedule execution on hypervisors. Synacktiv said the malware targeted files under /vmfs/volumes, powered off virtual machines, encrypted data with AES-256-CTR, appended RSA-encrypted metadata, and could also consume free disk space with random data.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
Synacktiv investigated a compromise involving a Hunters International ESXi ransomware variant that appeared after summer 2024. The case documented a full intrusion chain from initial access to ESXi encryption.
Multiple sources reported code overlap between Hunters International ransomware samples and Hive samples. Hunters International also said it had acquired Hive's source code while denying it was Hive's successor.
A joint Europol and FBI operation seized and shut down the Hive ransomware group's RaaS infrastructure. The report notes that no arrests were made in the takedown.
Quorum Cyber reported a new Remote Access Trojan named SharpRhino during a ransomware incident it attributed to Hunters International. The company assessed this was likely the first publicly reported deployment of SharpRhino by the group.
The day after the data exfiltration, the attackers started deploying ransomware against the victim's VMware infrastructure from CRITICAL_SERVER. Synacktiv's report says the operation used a custom ESXi encryptor delivered through PowerShell, VMware PowerCLI, and WinSCP Automation.
Two weeks after moving to CRITICAL_SERVER, the attackers accessed the company file server via RDP, installed Total Commander, and used its 7zip plugin to archive most file shares. They then used WinSCP Portable and a PuTTY private key to exfiltrate the archives to a remote server, likely over SFTP.
Using the local Administrator account over RDP, the attackers accessed CRITICAL_SERVER and installed SMOKEDHAM with a Run key named UpdateWindowsKey. They later added Kitty, Grabber, and Splashtop Remote Service to maintain access and continue lateral movement.
Weeks later, the attackers used Kitty, renamed fork.exe, to create a reverse SSH tunnel from the administrator workstation to an attacker-controlled AWS EC2 instance. The tunnel enabled RDP access to internal servers not exposed to the Internet.
Minutes after SMOKEDHAM was installed, the attackers deployed Kickidler Grabber using grem.msi on the administrator workstation. Grabber created a persistent Windows service named ngs running as LocalSystem.
The intrusion began when a system administrator downloaded RVTools from a malicious website promoted through malvertising. The trojanized installer executed the legitimate MSI while deploying malicious files and persistence for the SMOKEDHAM backdoor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used a custom Python ransomware script to encrypt virtual disks on a VMware ESXi hypervisor, taking the victim organization’s virtual machines offline after gaining access through a TeamViewer account that lacked multi-factor authentication on a system used by a Domain Administrator. Sophos said the intrusion moved from initial access to ransomware deployment in just over three hours, with the attackers scanning the network using Advanced IP Scanner and reaching the ESXi server through Bitvise after finding ESXi Shell enabled. The script, `fcker.py`, was copied to the hypervisor and executed against multiple datastores, where it shut down VMs, encrypted datastore files with OpenSSL using per-file AES material, overwrote the originals, and tried to remove evidence. Sophos identified the malware as **Troj/Ransom-GJR** and reported that it generated unique key pairs for each datastore run, leaving encrypted private keys on disk because it had no built-in exfiltration capability; the company urged organizations to harden ESXi, disable ESXi Shell when not required, and enforce MFA on privileged remote-access accounts.
Aug 14, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026