Scouting a Threat Actor

Censys researchers uncovered a previously undocumented HTTP-based command-and-control toolkit dubbed "SCOUT PROJECT" (server, admin client, dropper builder, payload) exposed in a public archive; the actor used custom tooling to scan for and attempt exploitation of multiple recent critical vulnerabilities (ViteJS CVE-2025-30208, Langflow CVE-2025-3248, Next.js CVE-2025-29927), deployed a malicious dropper that communicates with the C2 over HTTP using fake PNG framing and RC4, and successfully exfiltrated data from at least one target while leaving identifiable IOCs and search fingerprints for hunting additional deployments.