CobaltBus

CobaltBus Cobalt Strike का Azure Servicebus के साथ बाहरी C2 एकीकरण, Azure Servicebus के माध्यम से C2 ट्रैफिक सेटअप 1. एक Azure Service Bus बनाएं 2. एक साझा एक्सेस नीति कनेक्शन स्ट्रिंग बनाएं जो केवल भेज और सुन सके 3. Beacon C प्रोजेक्ट्स में static connectionString वेरिएबल को संपादित करें ताकि वह...

PingRAT

PingRAT PingRAT тайно передает C2-трафик через брандмауэры, используя ICMP-полезные нагрузки. Возможности: Использует ICMP для управления и контроля C2 Необнаруживаемый большинством решений AV/EDR Написан на Go Установка: Скачать бинарные файлы или соберите бинарные файлы и приступайте к работе:...

flightsim

Simulateur de vol réseau flightsim est un utilitaire léger utilisé pour générer du trafic réseau malveillant et aider les équipes de sécurité à évaluer les contrôles de sécurité et la visibilité réseau. L'outil effectue des tests pour simuler le tunneling DNS, le trafic DGA, les requêtes vers des...

C2-Hunter

C2-Hunter C2-Hunter هو برنامج مصمم لمحللي البرمجيات الخبيثة لاستخراج حركة مرور القيادة والتحكم C2 من البرامج الخبيثة في الوقت الفعلي. يستخدم البرنامج أسلوبًا فريدًا عن طريق ربط واجهات برمجة تطبيقات اتصالات win32. باستخدام C2-Hunter، يمكن لمحللي البرمجيات الخبيثة الآن اعتراض وتحليل الاتصالات في...

doublepulsar-c2-traffic-decryptor

저자: Luke Jennings [email protected] - @jukelennings 회사: Countercept @countercept 웹사이트: https://countercept.com PCAP 파일에서 DOUBLEPULSAR SMB 임플란트가 사용하는 C2 트래픽을 복호화하는 python2 스크립트입니다. 사용되는 암호화는 간단한 4바이트 XOR로, FUZZBUNCH 툴셋의 명령 출력에서 자주 볼 수 있습니다. 이 스크립트는 첫 번째 비-핑non-ping 패킷의 SESSIONSETUP 매개변수에 연속된...

ramnit_traffic_parser

ramnittrafficparser Если у вас есть трафик между Ramnit и C2, вы можете извлечь конфиги и модули Требования PHP 7 tshark Использование root@kitploit: $ php main.php pcap/URL Пример root@kitploit: $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" +...

loki-parse

loki-parse loki-bot악성코드과 관련된, 손상된 호스트와 C2 서버 간의 네트워크 트래픽을 탐지하고 파싱하는 Python 스크립트입니다. 이 스크립트는 C2로 유출되는 데이터가 무엇인지, 봇 추적 등을 알고 싶어하는 DFIR 분석가와 보안 연구자에게 유용할 수 있습니다. 이 스크립트는 스위치 없이 네트워크에서 직접 스니핑하거나--pcap $pcapfile 사용 네트워크 트래픽의 PCAP을 읽을 수 있습니다. 스크립트가 loki-bot 관련 네트워크 트래픽을 탐지하면 패킷에 포함된 데이터를 JSON 형식으로 화면에...

Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. "PowMix employs randomized command-and-control C2 beaconing intervals, rather than persisten...

New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication

Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service BITS as a command-and-control C2 mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Lab...

RedditC2 - Abusing Reddit API To Host The C2 Traffic, Since Most Of The Blue-Team Members Use Reddit, It Might Be A Great Way To Make The Traffic Look Legit

Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.  Disclaimer: Use of this project is for Educational/Testing purposes only. Using it on unauthorised machines is strictly forbidden. If somebody is...

Denonia cryptominer is first malware to target AWS Lambda

Security researchers at Cado Security, a cybersecurity forensics company, recently discovered the first publicly-known malware targeting Lambda, the serverless computing platform of Amazon Web Services AWS. Though Lambda has been around for less than ten years, serverless technology is considered...

CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 Traffic Via Azure Servicebus

Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match the "Primar...

Ryuk, Egregor Ransomware Attacks Leverage SystemBC Backdoor

Commodity malware backdoor SystemBC has evolved to now automate a number of key activities, as well as use the anonymizing Tor platform. These overarching changes make it both easier for cybercriminals to deploy the backdoor, as well as cloak the destination of the command-and-control C2 traffic...

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

Executive Summary We have discovered a global intrusion campaign. We are tracking the actors behind this campaign as UNC2452. FireEye discovered a supply chain attack trojanizing SolarWinds Orion business software updates in order to distribute malware we call SUNBURST. The attacker’s post...

Our Experiences Participating in Microsoft’s Azure Sphere Bounty Program | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

CSI: Evidence Indicators for Targeted Ransomware Attacks - Part II | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

DOUBLEPULSAR - Payload Execution and Neutralization Exploit

This Metasploit module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE. While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant. This...

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DOUBLEPULSAR Payload Execution and Neutralization', 'Description' = %q This module executes a Metasploit payload against the Equation Group's...

DOUBLEPULSAR Payload Execution / Neutralization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DOUBLEPULSAR Payload Execution and Neutralization', 'Description' = %q This module executes a Metasploit payload against the Equation Group's...

Brand-New SystemBC Proxy Malware Spotted Using SOCKS5 for Stealth

A previously undocumented proxy malware, dubbed “SystemBC,” is upping the stealth game by using SOCKS5 to evade detection. It’s being distributed by the Fallout and RIG exploit kits EKs, according to researchers. Proofpoint researchers said on Thursday that in the most recently tracked example, t...