sanslimit3
07Featured30Published

Research

Highlighted Research

Research archive

All Research

Latest first
Illustration of an exposed credential database and flowing identity recordsSansLimit3 · SEP 16, 20261.4 Billion Credential Records Exposed OnlineA misconfigured Elasticsearch instance exposed 360+ GB of aggregated credentials and U.S. consumer PII.→Formula 1 phishing campaign research bannerSOCRadar · AUG 05, 2026Formula 1 Phishing Campaign & Kit AnalysisA live-operated phishing campaign cloning ticket platforms to capture payment data and adapt 2FA challenges in real time.↗TeslaC2 investigation coverMedium · JUN 04, 2026TeslaC2 Exposed: A Full Malware-as-a-Service Framework Caught With Its Own Database OpenA misconfigured MaaS platform exposed its victims, infrastructure, database, and complete command-and-control operation.↗LLM automated exploitation pipeline coverMedium · MAY 11, 2026When LLMs Run the Attack ChainAn automated exploitation pipeline combining Hermes Agent, CyberStrikeAI, Sliver C2, and multiple LLMs.↗Chinese cybercrime exploitation and harvesting infrastructure research bannerSOCRadar · APR 30, 2026Chinese Cybercrime Infrastructure Detected: Automated Exploitation & Harvesting InfrastructureAutomated exploitation infrastructure combining internet-scale reconnaissance, credential harvesting, persistence, and monetization.↗KingBong botnet investigation coverMedium · APR 29, 2026KingBong: An AI-Built Rust Botnet Whose Only Victim Was Its Own CreatorA custom-branded Rust botnet exposed an ironic first infection: the developer’s own system.↗Fake Windows update RAT investigation coverMedium · APR 28, 2026Fake Windows Security Updates, Real RATA Portuguese-hosted operation chained a fake update, malware dropper, remote-access trojan, and malicious browser extension.↗PHANTOMREX2026 investigation coverMedium · APR 24, 2026PHANTOMREX2026: An AI-Assisted C2/RAT Framework Caught Mid-DevelopmentAn open directory captured an AI-assisted remote-access framework during its testing and self-experimentation phase.↗Elasticsearch 9.8 billion records research bannerSOCRadar · APR 20, 2026Public Elasticsearch Servers Expose 9.8 Billion Credential RecordsEnterprise, cloud, and AI platform credentials found across three publicly accessible Elasticsearch instances.↗Fake meeting invite malware campaign coverMedium · APR 06, 2026Fake Meeting Invites, Real MalwareA multi-domain malware campaign impersonating Zoom, ScreenConnect, and Google Meet.↗Open directory investigation coverMedium · MAR 30, 2026Inside an Open Directory: Source Code, a Control Panel, and Three Years of Telegram Chat HistoryAn exposed server revealed source code, operational tooling, and years of threat actor communications in one place.↗Signed Signature exploitation infrastructure coverMedium · MAR 19, 2026A Signed Signature: Exploitation Infrastructure Targeting Three Fresh CVEsInfrastructure targeting Indian critical systems with React2Shell, WebLogic, and SAP NetWeaver exploits.↗Exposed stealer logs and credit cards coverMedium · MAR 13, 202614 Million Stealer Logs, 63,000 Credit CardsA misconfigured Elasticsearch server exposed fresh stealer data, payment records, and historical breach material.↗KrakenNet exploitation infrastructure coverMedium · MAR 06, 2026Bash History Doesn’t LieExposed shell history revealed a CVE-2026-24061 exploitation server deploying KrakenNet and additional payloads.↗Elasticsearch 676 million identity records research bannerSOCRadar · MAR 03, 2026U.S. Elasticsearch Leak: 676M+ Identity Records & SSNs ExposedA publicly accessible instance exposing hundreds of millions of U.S. identity records and sensitive personal data.↗Telegram-controlled phishing farm investigation coverMedium · MAR 01, 2026One Server, Ten Ports, Ten Banks: A Telegram-Controlled Phishing FarmA single host powered a diversified phishing operation targeting multiple U.S. financial institutions.↗Elasticsearch 544 million credentials research bannerSOCRadar · FEB 24, 2026Public Elasticsearch Server Exposes 544M+ Plain-Text CredentialsA massive credential dataset left publicly accessible without authentication.↗Android malware factory investigation coverMedium · JAN 28, 2026A Turkish-Language “Malware Factory”: Inside an Android Trojan BuilderDefault access exposed an operational Android malware builder, its panel, and the production workflow behind it.↗Credential stealer investigation coverMedium · JUL 29, 2024490,000 Stolen Credentials: When a Stealer Operator Infected HimselfA Telegram-based credential stealer operation unraveled through the operator’s own operational security failure.↗Universe Spyware research coverMedium · JUN 25, 2024From Builder Panels to an Advertisement Page: Uncovering Universe SpywareTracing Hook and Ermac builder panels to the public storefront behind a malware-as-a-service operation.↗Supershell C2 research coverMedium · AUG 21, 2023Supershell: How an Open-Source Chinese C2 Platform Became a Threat Actor FavoriteResearch into how a polished open-source command-and-control platform was adopted for malicious operations at scale.↗Secure message phishing campaign coverMedium · DEC 08, 2022Anatomy of a Long-Running Credential Phishing CampaignThe “secure_message” HTML lure operation evolved its files, redirects, and domain infrastructure to resist takedowns.↗QakBot basic analysis coverMedium · NOV 03, 2021QakBot — Basic AnalysisA concise analysis of QakBot's infection flow, loader behavior, command execution, and anti-analysis techniques.↗