geacon

Geacon Usare Go per implementare il Beacon di CobaltStrike Questo progetto è solo per l'apprendimento dell'analisi dei protocolli e del reverse engineering; se qualcuno ha visto violati i propri diritti, contattami per rimuovere il progetto, e infine NON USARLO ILLEGALMENTE Come giocare 1...

SourcePoint

SourcePoint SourcePoint ist ein polymorpher C2-Profilgenerator für Cobalt Strike C2s, geschrieben in Go. SourcePoint ermöglicht die Erstellung einzigartiger C2-Profile im laufenden Betrieb, was dazu beiträgt, unsere Indicators of Compromise „IoCs“ zu reduzieren und dem Operator das Aufsetzen...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

lldp

lldp Profilo C2 Mythic per la comunicazione peer-to-peer su IEEE 802.1AB LLDP. I dati C2 sono trasportati all'interno di TLV specifici dell'organizzazione Tipo 127 con un OUI configurabile, in modo che le trame si confondano con le estensioni LLDP proprietarie dei vendor sulla rete. LLDP è solo d...

Malleable-C2-Randomizer

Malleable-C2-Randomizer Questo script randomizza i profili Malleable C2 di Cobalt Strike attraverso l'uso di un metalinguaggio, riducendo così le probabilità di attivare i controlli di rilevamento basati su firma. In breve, lo script analizza il template fornito, sostituisce le variabili con un...

CVE-2026-57952

Mythic before 3.4.0.60 contains an authorization bypass in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpo...

CVE-2026-57952 Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints c2profileconfigcheckwebhook, c2profileredirectruleswebhook, c2profilegetiocwebhook, c2profilesamplemessagewebhook that fail to verify payload ownership. An operator in one operation can invoke these...

RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check

0x00 Introduction Tool introduction RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex re...

PickleC2 - A Post-Exploitation And Lateral Movements Framework

PickleC2 is a post-exploitation and lateral movements framework. Documentation ReadTheDocs Overview PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements. PickleC2 has the ability to import your own PowerShell modul...

Nimplant - A Cross-Platform Implant Written In Nim

Nimplant is a cross-platform Linux & Windows implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated...

APT29 Re-Emerges After 2 Years with Widespread Espionage Campaign

A phishing campaign bent on espionage, believed to be launched by the nation-state threat group known as APT29, is targeting high-value targets across the think-tank, law enforcement, media, U.S. military, imagery, transportation, pharmaceutical, national government and defense contracting sector...