Threat Report: xHunt Targets Microsoft Exchange and IIS with Custom Backdoors

Threat researchers describe xHunt as an advanced persistent threat group that targets Microsoft Exchange and IIS web servers with custom backdoors, in campaigns that have persisted for years and focused on Kuwait, particularly in the shipping, transportation, and government sectors. The operation is noted for a distinctive toolkit and malware family names drawn from Hunter x Hunter, with threat actors also tracked as SectorD01, Hive0081, Cobalt Katana, and Hunter Serpens.

Historical techniques include a watering hole attack on a Kuwaiti government site that passively harvests NTLM hashes by triggering automatic browser authentication, using a file:// SMB reference to capture hashes.

In compromises of Exchange and IIS, xHunt deploys backdoors such as BumbleBee, TriFive and Snugy, with TriFive relying on legitimate user mailboxes and email drafts to retrieve payloads and execute commands via encrypted, base64‑encoded messages with the subject line “555.” The group’s 2019 campaigns named Hisoka, Sakabota, Netero and Killua, and it is noted that they used scheduled tasks and credential dumping alongside VPN infrastructure to maintain access and evade detection.