Loading threat actor…
Huna is a likely Vietnam-based cybercrime threat actor associated with phishing campaigns that impersonate job opportunities to target job seekers globally. The actor has been linked to delivery of PureRAT and additional malware through multi-stage infection chains designed to evade detection and establish access on victim systems. Attribution to Vietnam is supported by repeated Vietnamese-language development artifacts and naming conventions associated with the operation. Huna’s operations rely on social engineering themed around recruitment and employment. The actor has used trusted cloud-hosting services to distribute malicious archives, a tactic that can help bypass email security controls. After execution, the infection chain uses staged scripts to create concealed working directories, rename malicious components to appear benign, and launch payloads through DLL sideloading with legitimate-looking executables, including repurposed archive software. Python-based components are then used to retrieve final-stage malware. The tooling associated with Huna has shown signs consistent with the use of generative AI in both phishing content creation and malware development, including unusually detailed inline comments, numbered procedural steps, and operator-facing debug or instructional messages embedded in scripts. This suggests an operational workflow that uses AI assistance to accelerate development and campaign execution. Observed behavior indicates a financially motivated intrusion set rather than an espionage actor. The campaign appears oriented toward compromising individuals and potentially obtaining footholds that could be monetized directly or sold onward as initial access. Known aliases are limited, and Huna is the principal name associated with the activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated cybercrime activity targeting job seekers globally with fake job-offer lures to deliver PureRAT and other payloads, aiming to gain initial footholds in corporate networks (potentially for access resale). Campaign uses cloud hosting (e.g., Dropbox links) to bypass email controls, multi-stage infection chains, DLL sideloading with legitimate-looking executables, and AI-assisted development evidenced by unusually verbose Vietnamese comments and debug instructions in scripts.
Cybercrime-focused phishing campaign (job-offer lures) delivering PureRAT and HVNC payloads. Uses archive-based delivery (ZIP/RAR, sometimes via Dropbox links), DLL sideloading with legitimate executables (e.g., Haihaisoft PDF Reader/old Excel/Foxit variant), batch/Python loader scripts (with AI-like verbose Vietnamese comments), and persistence via HKCU Run key and sometimes scheduled tasks. Likely aims to gain footholds and potentially sell access to other actors.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.