Adversary tracking
We follow infrastructure rather than names. Domain impersonation patterns, JARM fingerprints, ASN correlation and hosting reuse — the artefacts an actor cannot easily discard between campaigns.
Evidence — Scattered Spider暁 AKATSUKI · DAYBREAK
The watch is kept before first light.
We are an independent research collective. We track adversary infrastructure, take apart intrusion campaigns, and publish the methodology alongside the findings so defenders can reproduce the work, not just read about it.
3 published reports Independent Open methodology & indicators
Joining forces with Hunt.io
POWERED BY HUNT.IOPowered by Hunt.io
Akatsuki Legion is an independent community of threat intelligence researchers focused on adversary infrastructure: tracking how actors provision, reuse, and burn through their assets over time.
Our work combines open source intelligence with a small set of carefully chosen commercial platforms. Hunt.io is one of the few we rely on: it gives us historical infrastructure visibility, archived open directories, and pivotable context that turns OPSEC mistakes into leads, not anecdotes.
Their support helps us keep the research independent and reproducible: every hunt we publish is something defenders can rerun, adapt, and extend inside their own environments.
What we do
FOUR PRACTICESCampaign analysis
End-to-end reconstruction of intrusion campaigns: initial access, lure design, execution chain, and the detection opportunities each stage leaves behind.
Evidence — Operation Black MirrorBreach & blockchain forensics
Post-incident analysis of financial-sector compromise, including on-chain tracing of stolen funds and reconstruction of the attacker's path through internal systems.
Evidence — NobitexDetection engineering
Hunting queries and detection logic released with every report, so a finding becomes something you can run rather than something you have to trust.
In progress — release date not yet setSelected research
2025Scattered Spider: Many Names, One Syndicate
A financially motivated collective that weaponises social engineering over malware — mapped through domain impersonation, JARM pivoting and IOC clustering.
Operation Black Mirror: ClickFix Campaign Analysis
Multi-campaign analysis of ClickFix operations run by both APT actors and crimeware crews, focused on Win+R lures and infrastructure-level hunting.
When the Bazaar Burned From Within: The Silent Breach of Nobitex
How a cryptocurrency exchange was taken apart from the inside, and what its internal architecture revealed once the attackers published it.
Work with us
We are open to research partnerships, sponsorship of published work, conference collaboration, and applications from analysts who want to publish under their own name.