APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

BounceBack

BounceBack ↕️🤫 Stealth redirector for your red team operation security. Overview BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic...

ycsm

당신은 나를 볼 수 없습니다 YCSM 이것은 nginx 리버스 프록시와 letsencrypt를 사용하여 복원력 있는 리다이렉터를 위한 빠른 스크립트 설치입니다. 일부 인기 있는 RATSCobalt Strike, Empire, Metasploit와 호환됩니다. HTTPS를 선택하면 letsencrypt certbot을 자동으로 설정하고 리다이렉터 도메인 이름에 대한 유효한 letsencrypt SSL 인증서를 획득하며 생성된 구성을 사용하여 nginx를 시작합니다. 리다이렉터를 사용하면 도메인이 손상된 경우 별도 호스트를 사용하...

DoH_c2_Trigger

DoHc2Trigger 블로그 게시물용 코드: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/...

GOXLR-malware-family

This repo initially was my analysis and report for malware found at goxlr.net. Recently I uncovered they ALSO ran several other malware domains with varying malware variants, so far all stealers, and they are all a clone of "goxlr". So I am now reverse engineering every sample I can find from all...

fronthunter

FrontHunter FrontHunter is a tool for testing large lists of domains to identify candidates for domain fronting. Domain Fronting? Really? I know, I know… domain fronting is pretty old. But the truth is, it’s still useful as just another feature to include in your C2 infrastructure. When it comes ...

BitLock-Crypto-Research

🛡️ BitLock Framework: Cryptovirology and C2 Ecosystem PoC This repository contains a comprehensive Proof of Concept PoC designed for the study of modern threat architectures. The project simulates a fileless attack environment with a command and control C2 infrastructure protected by elliptic curv...

GithubC2

GithubC2 Github을 C2 데모로 활용, 무료 API = 무료 C2 인프라 데모 https://user-images.githubusercontent.com/110354855/192076474-3c1884f8-4a59-4944-b0d6-9dc59c7692f0.mp4...

AutoFunkt

AutoFunkt d8888 888 8888888888 888 888 d88888 888 888 888 888 d88P888 888 888 888 888 d88P 888 888 888 888888 .d b. 8888888 888 888 88888b. 888 888 888888 d88P 888 888 888 888 d88 88b 888 888 888 888 "88b 888 .88P 888 d88P 888 888 888 888 888 888 888 888 888 888888K 888 d8888888888 Y88b 888 Y88b...

CVE-2026-33634-Scanner

CVE-2026-33634-Scanner TeamPCP 공급망 공격CVE-2026-33634과 관련된 침해 지표IOC 탐지를 위한 자동화 스캐너 📋 목차 개요 취약점 기능 탐지되는 IOC 설치 사용법 예시 보고서 형식 프로젝트 구조 시스템 요구 사항 기여 라이선스 저자 참고 자료 🎯 개요 CVE-2026-33634-Scanner 는 손상된 채널을 통해 배포되는 여러 소프트웨어 구성 요소에 영향을 미치는 치명적인 취약점인 TeamPCP 공급망 공격과 관련된 침해 지표IOC를 탐지하도록 설계된 보안 도구입니다. 이 도구는 다음을...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2 인프라 – 복원력과 중복성을 갖춘 서버 Process Hacker 메모리 분석을 통해 Dropper GCleaner가 C2 통신에 사용하는 포괄적인 도메인 목록이 확인되었습니다. 이러한 도메인은 다양한 플랫폼Scaleway, Render, Replit 등에 호스팅되어 있으며, 이는 견고하고 중복된 인프라를 나타냅니다. 주요 관찰 사항: 호스팅 제공 업체: Scaleway scw.cloud, Render onrender.com, Replit repl.co 등. 도메인: readthedocs.io, rhcloud.com...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

Malicious code in @marketfront/baobabtech (npm)

The @marketfront/baobabtech package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6786 Malicious code in @marketfront/mychatspreloader (npm)

The @marketfront/mychatspreloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and us...

MAL-2026-6772 Malicious code in @marketfront/customdealsfeed (npm)

The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-5164 Malicious code in @emcd-vue/b2b-pay-form (npm)

Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform...

New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations

Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations NGOs and suspected universities to deliver a newly identified malware family, "LucidRook." LucidRook is a sophisticated stager that embeds a Lua...

New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys

Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent. The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs researcher SangRyol Ryu said in an...

Living off the land with Bluetooth PAN

TL:DR Bluetooth is enabled by default on the majority of Windows laptops Bluetooth PAN can be used to bridge connections locally between a client laptop and attacking device Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is accessible to...