Insights and research on cybersecurity, threat intelligence, and infrastructure protection.
Oasis Security analyzed attacker-server tools and callback logs showing unauthenticated LocalAI instances used for remote code execution, including compromise of a desktop LocalAI workstation in Thailand and theft of AWS ECS credentials.
ARTHUR identified public IP infrastructure associated with the Russian-speaking drug trafficking group Stuffman, including a FlokiNET origin address that remained reachable after stuffman[.]io was placed behind Cloudflare.
Analysis of PhishPage v2.1 infrastructure identified a centralized framework used to manage phishing sites impersonating multiple dark web services, collect account credentials and cryptocurrency-related information, replace wallet addresses, and automate account hijacking activities.
Analysis of server-side data associated with The Gentlemen ransomware group identified the complete TukTuk C2 project structure, DLL side-loading configurations, EDR neutralization research, vulnerable driver materials, and data assessed to have been exfiltrated from multiple organizations.
Analysis of recovered AI-session logs and attacker-side artifacts associated with activity against Brazilian public-sector and commercial organizations, including credential abuse, webhook-based collection, and unverified attacker-generated impact claims.
Analysis of attempted Apache Solr SSRF against a Mexican public-sector organization and heuristic credential testing against Colombian public-sector login services; no data retrieval or successful authentication was independently confirmed.
Recovered attacker tooling identified 100 authentication-bypass-positive hosts, confirmed command execution on 59, and staged a seven-architecture reverse-SSH backdoor family.
Analysis of CaLA, a Japanese-language dark web marketplace specializing in cannabis and psychedelic drugs, and its active Tor and Clearnet infrastructure.
Oasis Security identified a large-scale Adobe ColdFusion exploitation campaign that deployed command-execution webshells across 4,244 compromised URLs.
Analysis of the Nova ransomware group's infrastructure identified a public domain associated with Nova Clouds and the commercial hosting platform used to host the group's infrastructure.
![Sliver Threat Intelligence: Infrastructure, Trends, and Key Insights [March 2026 - May 2026]](/blog-images/sliver/fig_0.jpg)
Originally developed for legitimate adversary emulation, Sliver has become one of the most widely observed open-source command-and-control frameworks in modern cyber operations. This report explores its evolution and analyzes Sliver infrastructure observed by Oasis Security between March 2026 and May 2026.
Oasis Security identified AI-assisted SQL injection activity through analysis of server-side artifacts collected from an exposed attack server, uncovering attacker infrastructure, targeting patterns, and operational workflows.
Oasis Security's dark web intelligence platform, ARTHUR, leveraged infostealer-derived browser artifacts to identify visitors to North Korean websites, uncovering associated identities, activities, and contextual intelligence beyond traditional credential-based analysis.
Oasis Security identified a Claude AI-powered automated attack framework named Hephaestus that was used to target government agencies and educational institutions across Indonesia, Bangladesh, Thailand, and South Korea.
Oasis Security identified a targeted intrusion campaign against multiple Malaysian government organizations, characterized by purpose-built Python tooling per target for internal enumeration and data exfiltration, active webshell deployment, and previously undisclosed C2 infrastructure including a C# beacon and Python-based controller.
A dark web-based hacking-for-hire platform, Darkhub, was analyzed, revealing publicly exposed infrastructure and a broad range of illicit cyber service offerings.
Oasis Security identified a large-scale intrusion campaign leveraging Exchange SSRF exploitation, credential harvesting, and vulnerability scanning targeting diplomatic infrastructure and strategic organizations across multiple regions.
Oasis Security identified a publicly exposed backend IP linked to the TreFratelli Drug Shop dark web site.
A multi-stage campaign combining large-scale vulnerability scanning, credential harvesting, and confirmed data exfiltration targeting aviation, energy, and government sectors in the Middle East.
Oasis Security identified an intrusion campaign in which the attacker used Anthropic’s Claude AI to support reconnaissance, SQL injection, credential stuffing, and lateral movement against Mexican government-related targets, resulting in large-scale data exfiltration.
A dark web site offering Bitcoin mixing and wallet hacking services was identified, along with its exposed infrastructure.
Oasis Security identified publicly exposed infrastructure associated with the HackBit dark web forum.
Oasis Security identified SQL injection activity targeting a Hungarian ISP-associated hostname and additional web services, resulting in successful database enumeration and accompanied by reconnaissance involving U.S. military (.mil) domains.
Oasis Security identified multiple onion domains and associated public IP infrastructure linked to the dark web credit card marketplace 'Best CVV Online, Fresh CVV'.
Oasis Security identified active exploitation of FortiWeb devices leveraging an exploit chain combining CVE-2025-64446 and CVE-2025-58034. Attacker-side artifacts confirm credential provisioning and validation across 51 websites, along with tooling indicative of remote host control capabilities.
Oasis Security identified attacker infrastructure linked to the compromise of an Egyptian professional services platform used by engineers, doctors, and other licensed professionals, resulting in large-scale personal data exfiltration.
Oasis Security identified domain infrastructure and historical IP records associated with the THIEF dark web marketplace.
Oasis Security identified and analyzed a large-scale intrusion campaign targeting Tunisian government entities and a French healthcare company, involving SQL injection exploitation, database dumping, web shell deployment, and internal network propagation.
Oasis Security identified an active SQL injection campaign, resulting in confirmed data exfiltration from multiple enterprise websites, including a global payment service provider.
Oasis Security identified a dark web service offering active Western Union MTCN transaction identifiers, hosted on infrastructure also linked to a Bitcoin mixing operation.
Oasis Security identified a widespread automated intrusion campaign leveraging SQL injection and obfuscated PHP web shells to compromise government, educational, and commercial websites across multiple countries, resulting in large-scale data exfiltration and exposure of approximately 28 million browser-stored credentials.
Oasis Security identified exposed backend infrastructure supporting both a financial data marketplace and a drug trafficking platform on the dark web, revealing a shared public IP address and operational overlap between distinct illicit services.
Oasis Security identified multiple active exploitation operations involving Oracle E-Business Suite RCE, React2Shell-based REC, and large-scale WordPress credential harvesting, based on attacker-side artifacts that confirm successful intrusion and post-exploitation activity.
Oasis Security identified a targeted intrusion operation involving prior internal network access, credential abuse, and automated data exfiltration affecting multiple websites referencing Vietnam Post operations.
Oasis Security uncovered a publicly exposed backend IP linked to the Cash God dark web site, revealing weaknesses in its intended anonymity controls.
Oasis Security uncovered multiple real-world intrusions abusing Magento CVE-2025-54236, demonstrating how the vulnerability is being leveraged for both mass root-level compromise and targeted web shell attacks across different regions.
Oasis Security provides an in-depth analysis of AKIRA ransomware’s dark web extortion infrastructure, highlighting public IP exposure and recurring backend configuration patterns despite frequent infrastructure rotation.
Oasis Security identified and analyzed a coordinated intrusion campaign spanning Brazil, Guinea, and the United States, revealing confirmed internal network compromises and deliberate post-exploitation activity rather than opportunistic scanning.
Oasis Security identified a large-scale automated scanning and exploitation campaign targeting Israeli and global government infrastructure by abusing recently disclosed React vulnerabilities.
Oasis Security researchers identified two separate compromise incidents—targeting an Indian university and a Cambodian government agency—both leveraging the same SQL injection exploitation technique.
We're preparing new research and practical guides—stay tuned for the next blog release.