APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

GOXLR-malware-family

यह रिपॉजिटरी शुरू में goxlr.net पर पाए गए मैलवेयर के लिए मेरा विश्लेषण और रिपोर्ट थी। हाल ही में मैंने पाया कि उन्होंने विभिन्न मैलवेयर वेरिएंट वाले कई अन्य मैलवेयर डोमेन भी चलाए, अब तक सभी स्टीलर हैं, और वे सभी "goxlr" का क्लोन हैं। इसलिए अब मैं उनके सभी डोमेन से मिलने वाले हर नमूने का रिवर्स...

DoH_c2_Trigger

DoHc2Trigger Code pour l'article de blog : https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/...

BounceBack

BounceBack ↕️🤫 معيد توجيه خفي لأمان عمليات فريقك الأحمر. نظرة عامة BounceBack هو وكيل عكسي قوي وقابل للتخصيص والتكوين بدرجة عالية مع وظيفة WAF لإخفاء البنية التحتية الخاصة بـ C2/التصيد/إلخ عن الفرق الزرقاء، وصناديق الرمل، والماسحات الضوئية، إلخ. يستخدم تحليل حركة المرور في الوقت الفعلي من خلال...

fronthunter

FrontHunter FrontHunter هي أداة لاختبار قوائم كبيرة من النطاقات لتحديد المرشحين المحتملين لتقنية "توجيه النطاق" Domain Fronting. توجيه النطاق؟ حقاً؟ أعلم، أعلم… توجيه النطاق قديم جداً. لكن الحقيقة أنه لا يزال مفيداً كميزة إضافية في البنية التحتية لـ C2 الخاصة بك. وعندما يتعلق الأمر بالنطاقات، فلا...

ycsm

You Can't See Me YCSM यह nginx रिवर्स प्रॉक्सी और letsencrypt का उपयोग करके एक लचीले रिडायरेक्टर के लिए त्वरित स्क्रिप्ट इंस्टॉलेशन है, जो कुछ लोकप्रिय RATS Cobalt Strike, Empire, Metasploit के साथ संगत है। यदि HTTPS चुना गया था, तो यह स्वचालित रूप से letsencrypt certbot सेटअप करेगा और आपके...

BitLock-Crypto-Research

🛡️ إطار BitLock: نظام بيئي للفيروسات المشفرة والتحكم PoC يحتوي هذا المستودع على إثبات مفهوم PoC شامل مصمم لدراسة بنى التهديدات الحديثة. يحاكي المشروع بيئة هجوم بدون ملفات مع بنية تحتية للتحكم والسيطرة C2 محمية بتشفير المنحنيات الإهليلجية وبروتوكولات المسح الآمن. 🔬 تحليل دورة حياة الهجوم يعمل النظا...

GithubC2

GithubC2 Github एक C2 डेमोन्स्ट्रेशन के रूप में , मुफ्त API = मुफ्त C2 इंफ्रास्ट्रक्चर डेमो https://user-images.githubusercontent.com/110354855/192076474-3c1884f8-4a59-4944-b0d6-9dc59c7692f0.mp4...

AutoFunkt

AutoFunkt root@kitploit: d8888 888 8888888888 888 888 d88888 888 888 888 888 d88P888 888 888 888 888 d88P 888 888 888 888888 .d b. 8888888 888 888 88888b. 888 888 888888 d88P 888 888 888 888 d88 88b 888 888 888 888 "88b 888 .88P 888 d88P 888 888 888 888 888 888 888 888 888 888888K 888 d8888888888...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. البنية التحتية لـ C2 – خوادم مرنة ومتكررة يكشف تحليل ذاكرة Process Hacker عن قائمة شاملة بالنطاقات التي يستخدمها Dropper GCleaner للتواصل مع خوادم C2. هذه النطاقات مستضافة على منصات متعددة Scaleway، Render، Replit، وغيرها، مما يشير إلى بنية تحتية قوية ومتكررة. الملاحظات الرئيسية: موفرو...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

Malicious code in @marketfront/baobabtech (npm)

The @marketfront/baobabtech package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6786 Malicious code in @marketfront/mychatspreloader (npm)

The @marketfront/mychatspreloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and us...

MAL-2026-6772 Malicious code in @marketfront/customdealsfeed (npm)

The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-5164 Malicious code in @emcd-vue/b2b-pay-form (npm)

Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform...

New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations

Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations NGOs and suspected universities to deliver a newly identified malware family, "LucidRook." LucidRook is a sophisticated stager that embeds a Lua...

New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys

Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent. The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs researcher SangRyol Ryu said in an...

Living off the land with Bluetooth PAN

TL:DR Bluetooth is enabled by default on the majority of Windows laptops Bluetooth PAN can be used to bridge connections locally between a client laptop and attacking device Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is accessible to...

Warning: Markopolo's Scam Targeting Crypto Users via Fake Meeting Software

A threat actor who goes by alias markopolo has been identified as behind a large-scale cross-platform scam that targets digital currency users on social media with information stealer malware and carries out cryptocurrency theft. The attack chains involve the use of a purported virtual meeting...