About the ledger
Original Threat Intelligence Research
Hands-on malware analysis turned into structured, evidence-based intelligence, technically deep enough to trust and clear enough to act on. Free and open: published by a solo analyst for the defender community, with no paywall or signup.
Mission
Most threat intelligence fails defenders in one of two ways. It is either too shallow to be actionable (headlines dressed up as analysis), or technically rigorous but locked behind paywalls, stripped of indicators, and written for researchers rather than the people responding at 2am.
The Hunter's Ledger exists to fill that gap. Every report here is built from original research: real samples, real infrastructure, real detections. The goal is intelligence that a defender can open, read, and act on the same day, with IOCs ready to ingest, detection rules ready to deploy, and analysis deep enough to actually understand what a threat does and how to stop it.
All of it is free. Defenders should not have to pay to defend.
Help Desks to Host Shells Across Brazil's Public Sector
An unnamed operator's open directory shows command execution inside two Brazilian federal bodies, a stolen EDR console token, monitoring servers turned into a command plane and a plaintext relay on TCP 53, across 92 public-sector organisation rows.
57 techniques · 13 tacticsDistinct ATT&CK techniques per tactic, from the report
| Tactic | Techniques |
|---|---|
| Reconnaissance | 4 |
| Resource Development | 0 |
| Initial Access | 3 |
| Execution | 2 |
| Persistence | 2 |
| Privilege Escalation | 0 |
| Stealth | 3 |
| Defense Impairment | 1 |
| Credential Access | 12 |
| Discovery | 14 |
| Lateral Movement | 2 |
| Collection | 4 |
| Command and Control | 7 |
| Exfiltration | 2 |
| Impact | 1 |
Takedowns & Victim Actions counts only what was reported back to me; most of my reports get no reply.