xHunt

Summary

Espionage cluster that Unit 42 named xHunt in 2019 after the Hunter x Hunter character names its developer gave the tools (Sakabota, Hisoka, Netero, Killua, Gon, EYE). Active since at least July 2018 against Kuwait government and shipping and transportation organisations. Its backdoors talk to their operators over HTTP, DNS tunnelling (T1071.004) and, unusually, email drafts created through Exchange Web Services with stolen credentials. In 2020 Unit 42 found it on a Kuwaiti Exchange server, persisting through scheduled tasks (T1053.005) that ran the PowerShell backdoors TriFive and Snugy (T1059.001) beside the BumbleBee web shell (T1505.003). Sophos CTU, which tracks it as COBALT KATANA, assesses with moderate confidence that it operates on behalf of Iran and sees infrastructure and tradecraft connections to OilRig (COBALT GYPSY) and DNSpionage (COBALT EDGEWATER); Unit 42 makes no attribution.

Attribution

Single vendor (Sophos CTU, moderate); Unit 42, which named it, does not attribute

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Sophos CTU (Research, 2026-10)
  Operates on behalf of Iran (moderate confidence)

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 9

Infrastructure patterns

• C2 over HTTP, DNS tunnelling or EWS email drafts with stolen credentials (Unit 42, 2019)
• TriFive C2 via drafts in a mailbox's Deleted Items; Snugy over DNS tunnelling (Unit 42, 2020)

Reporting and advisories 4

• Unit 42
  xHunt Campaign: attacks on Kuwait shipping and transportation organizations (Sep 2019)
• Unit 42
  xHunt Campaign: newly discovered backdoors using deleted email drafts and DNS tunneling for C2 (Nov 2020)
• Sophos CTU
  COBALT KATANA threat profile
• Unit 42
  xHunt Campaign: New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement (Jan 2021)