Adversary tracking
We follow infrastructure rather than names. Domain impersonation patterns, JARM fingerprints, ASN correlation and hosting reuse — the artefacts an actor cannot easily discard between campaigns.
Evidence — Scattered Spider暁 AKATSUKI · DAYBREAK
The watch is kept before first light.
We are an independent research collective. We track adversary infrastructure, take apart intrusion campaigns, and publish the methodology alongside the findings so defenders can reproduce the work, not just read about it.
6 published reports Independent Open methodology & indicators
Sponsered By Hunt.io
Akatsuki Legion is an independent community of threat intelligence researchers focused on adversary infrastructure: tracking how actors provision, reuse, and burn through their assets over time.
Our work combines open source intelligence with a small set of carefully chosen commercial platforms. Hunt.io is one of the few we rely on: it gives us historical infrastructure visibility, archived open directories, and pivotable context that turns OPSEC mistakes into leads, not anecdotes.
We are incredibly grateful to Hunt.io for sponsoring the Akatsuki Legion without their sponsorship, this research wouldn't be possible and we will honor their trust by working relentlessly to protect every village we can.Their support helps us keep the research independent and reproducible, every hunt we publish is something defenders can rerun, adapt, and extend inside their own environments.
What we do
FOUR PRACTICESCampaign analysis
End-to-end reconstruction of intrusion campaigns: initial access, lure design, execution chain, and the detection opportunities each stage leaves behind.
Evidence — Operation Black MirrorBreach & blockchain forensics
Post-incident analysis of financial-sector compromise, including on-chain tracing of stolen funds and reconstruction of the attacker's path through internal systems.
Evidence — NobitexDetection engineering
Hunting queries and detection logic released with every report, so a finding becomes something you can run rather than something you have to trust.
In progress — release date not yet setSelected research
LATEST RESEARCHDisect Netscaler Citrix Vulnerability CVE 2026-88771/72 - Uncovering the exploit & it's infrastructure
In September 2026, Citrix disclosed two critical vulnerabilities: CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. Both carry a 9.5 CVSS score and affect default configurations. Approximately 50,000 internet-exposed NetScaler instances were reachable at the time of disclosure. This research analyzes a captured operations console at `66.154.127.156` (AS35916 MULTACOM CORPORATION, Leesburg, Virginia).
Suspected Sidewinder Campaign Against South Asian Governments and Finance Targets
While threat hunting, we identified an exposed VPS at 66.179.31[.]191 hosted on BL Networks (AS399629) in Singapore. The host ran a Python SimpleHTTP server on port 8898 with directory listing enabled. AttackCapture archived the directory and flagged it as a potential malicious open directory. What it exposed was a working attack server: 395 files across 9 subdirectories, roughly 182 MB, containing exploit code for GeoServer, GeoTools, Laravel Ignition, Tomcat, and a Redis module loader, along with phpMyAdmin weak-credential scripts, target lists, session cookies, C2 configuration, and operational logs.
Inside PlayCrypt: Deconstructing the Amadey → Cobalt Strike → Play Multi-Stage Ransomware Chain
One file hash. A few pivots. That's all it took to walk straight into Play ransomware's back office: a Cobalt Strike server on Tencent loaded with exploit and credential-theft scripts, a live Sliver C2 host, and a team server actively churning out evasive Windows payloads, all sitting in open directories, no victim network required. A misconfigured leak site handed over Play's negotiation timelines for free. And one intrusion traced back to a single binary carrying Amadey, Cobalt Strike, Elex, and the Play encryptor together, proof that if you're only watching the network, you're already too late.
Work with us
We are open to research partnerships, sponsorship of published work, conference collaboration, and applications from analysts who want to publish under their own name.