ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Responder

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

xHunt Campaign: New Watering Hole Identified for Credential Harvesting

Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.

Palo Alto Unit 42 identified a Kuwait government organization's webpage injected with hidden HTML referencing image paths on domains (microsofte-update.com, learn-service.com) tied to xHunt/Hisoka C2 infrastructure. When visitors loaded the page, Windows would attempt SMB/NetBIOS authentication to the remote share, allowing the operators to capture NTLM hashes that could be cracked or relayed. Related DNS redirect activity on xHunt infrastructure in 2019 pointed to additional credential-harvesting interest against Kuwaiti government email servers.

Palo Alto Unit 42 · 29d agoThreat actor in the wild

Appears with

threat actor xHunt 1organization Palo Alto Networks 1organization RiskIQ 1product AutoFocus 1product WildFire 1vendor Palo Alto Networks 1victim Kuwait government organization 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.