Adversary tracking
We follow infrastructure rather than names. Domain impersonation patterns, JARM fingerprints, ASN correlation and hosting reuse — the artefacts an actor cannot easily discard between campaigns.
Evidence — Scattered Spider暁 AKATSUKI · DAYBREAK
The watch is kept before first light.
We are an independent research collective. We track adversary infrastructure, take apart intrusion campaigns, and publish the methodology alongside the findings so defenders can reproduce the work, not just read about it.
8 published reports Independent Open methodology & indicators
Sponsered By Hunt.io
Akatsuki Legion is an independent community of threat intelligence researchers focused on adversary infrastructure: tracking how actors provision, reuse, and burn through their assets over time.
Our work combines open source intelligence with a small set of carefully chosen commercial platforms. Hunt.io is one of the few we rely on: it gives us historical infrastructure visibility, archived open directories, and pivotable context that turns OPSEC mistakes into leads, not anecdotes.
We are incredibly grateful to Hunt.io for sponsoring the Akatsuki Legion without their sponsorship, this research wouldn't be possible and we will honor their trust by working relentlessly to protect every village we can.Their support helps us keep the research independent and reproducible, every hunt we publish is something defenders can rerun, adapt, and extend inside their own environments.
What we do
FOUR PRACTICESCampaign analysis
End-to-end reconstruction of intrusion campaigns: initial access, lure design, execution chain, and the detection opportunities each stage leaves behind.
Evidence — Operation Black MirrorBreach & blockchain forensics
Post-incident analysis of financial-sector compromise, including on-chain tracing of stolen funds and reconstruction of the attacker's path through internal systems.
Evidence — NobitexDetection engineering
Hunting queries and detection logic released with every report, so a finding becomes something you can run rather than something you have to trust.
In progress — release date not yet setSelected research
LATEST RESEARCHInside REVSTEALER's Growing Distribution Ecosystem
REVSTEALER has rapidly matured into one of the most operationally sophisticated infostealers observed in the current threat landscape. An industrial-scale, financially motivated campaign that weaponizes the gaming-cheat and fake-AI-tool economy to deliver a multi-stage, VMProtect-packed payload through more than 100 interconnected domains, trojanized Electron applications masquerading as Anthropic's Claude Opus 5, and hijacked YouTube distribution channels. Once executed, the malware performs a ten-point weighted sandbox-evasion scoring routine, decrypts an AES-256-CBC in-memory payload, and leverages fourteen indirect syscall wrappers and FNV-1a API hashing to bypass user-mode hooks before systematically harvesting credentials from browsers, password managers, cryptocurrency wallets, Steam, Roblox, Battle.net, EA Desktop, and Minecraft; then exfiltrating the loot as streamed, encrypted typed records over HTTPS, with a resilient Polygon blockchain dead-drop resolver standing by as a fallback command-and-control channel. With no persistence by design, self-deletion as a closing act, and a CIS-region language exclusion built into its host-validation gate, REVSTEALER represents a deliberate, high-tempo smash-and-grab operation that prioritizes volume over dwell time—and its combination of consumer-grade lures with nation-state-grade tradecraft makes it a formidable and fast-moving threat that defenders can no longer afford to treat as commodity malware.
PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational Infrastructure
PHP2shell Critical Vulnerabilities Affecting 70% Of The Internet. The rapid weaponization of PHP2Shell demonstrates how fundamental engine vulnerabilities bypass traditional perimeter defenses. Within days of disclosure, diverse UNC actors integrated automated exploitation scripts into their campaigns, targeting a massive attack surface.
Disect Netscaler Citrix Vulnerability CVE 2026-88771/72 - Uncovering the exploit & it's infrastructure
In September 2026, Citrix disclosed two critical vulnerabilities: CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. Both carry a 9.5 CVSS score and affect default configurations. Approximately 50,000 internet-exposed NetScaler instances were reachable at the time of disclosure. This research analyzes a captured operations console at `66.154.127.156` (AS35916 MULTACOM CORPORATION, Leesburg, Virginia).
Work with us
We are open to research partnerships, sponsorship of published work, conference collaboration, and applications from analysts who want to publish under their own name.