XHunt — Threat Actor Profile, Campaigns & Targets

Overview

XHunt is an Advanced Persistent Threat (APT) group observed in 2025 that targets Windows infrastructure by exploiting internet-facing Microsoft Exchange and IIS Web Server deployments to deploy bespoke backdoors. Their focus on Exchange and IIS and deployment of custom backdoors indicates a persistent capability to gain and maintain access within enterprise networks.

Related Threat Clusters

• Exploitation of FortiGate SSO Vulnerabilities by Threat Actors

  Threat actors are actively exploiting critical authentication bypass vulnerabilities in Fortinet's FortiGate appliances, specifically CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow unauthenticated single…

  4 articles · Updated December 16, 2025
• xHunt APT Targets Microsoft Exchange and IIS with Custom Backdoors

  The xHunt APT group is conducting targeted cyber-espionage campaigns against organizations in Kuwait, specifically focusing on the government, shipping, and transportation sectors. They exploit vulnerabilities in…

  2 articles · Updated December 15, 2025
• ZnDoor Malware Targets React2Shell Vulnerability in Japanese Networks

  In December 2025, Japanese organizations are facing attacks exploiting the React2Shell vulnerability (CVE-2025-55182) in React/.js applications. Initially used for cryptocurrency mining, the ZnDoor malware has evolved…

  3 articles · Updated December 15, 2025

Recent Intelligence Reports

• Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild — Cybersecuritynews · December 16, 2025
• ZnDoor Malware Exploiting React2Shell Vulnerability to Compromise Network Devices — Cybersecuritynews · December 15, 2025
• xHunt APT Hackers Attacking Microsoft Exchange and IIS Web Servers to Deploy Custom Backdoors — Cybersecuritynews · December 15, 2025
• xHunt APT Exploits Microsoft Exchange and IIS to Deploy Custom Backdoors — Gbhackers · December 15, 2025

Related Entities