99 matches found
CoffeeLdr
CoffeeLdr CoffeeLdr è un loader per i cosiddetti Beacon Object Files. Questo progetto può essere utilizzato per testare i Beacon Object file senza usare il framework Cobalt Strike oppure può essere usato per dare agli implant personalizzati un modo per eseguire BOF progettati per Cobalt Strike...
CrucibleC2
HardHat C2 Un framework Command & Control cross‑platform, collaborativo, scritto in C, progettato per red teaming e facilità d'uso HardHat è un framework multi‑utente Command & Control C2 basato su C .NET, progettato per supportare operazioni di red team e penetration test. Mira a migliorare la...
sliver
Sliver Sliver è un framework open source multipiattaforma di emulazione avversaria/red team, che può essere utilizzato da organizzazioni di ogni dimensione per eseguire test di sicurezza. Gli implant di Sliver supportano C2 su Mutual TLS mTLS, WireGuard, HTTPS e DNS e sono compilati dinamicamente...
RedTeam-Physical-Tools
Red Team – Sicurezza Fisica – Ingresso Nascosto – EDC Una lista curata di strumenti disponibili in commercio comunemente menzionati in valutazioni di sicurezza fisica autorizzate , attività di red team e formazione per l'ingresso nascosto. Legale ed Etica: Utilizzare solo con autorizzazione scrit...
hollows_hunter
hollowshunter...
EQGRP_Lost_in_Translation
EQGRP Lost in Translation Contenuto decriptato di odd.tar.xz.gpg, swift.tar.xz.gpg e windows.tar.xz.gpg Scaricato da https://yadi.sk/d/NJqzpqo3GxZA4 Post originale dei ShadowBrokers https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation windows : contiene exploit, implant e paylo...
MAL-2026-2278 Malicious code in python-aiogram-telegram-updater (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 94b286136c318836563c0eaddf44e8d1b21f217086b444a3266d91b69ace79b8 When run, the package exfiltrates files from a cryptowallet and modifies its executable placing an implant exfiltrating passphrase later. --- Category: MALICIO...
China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks
A long-term and ongoing campaign attributed to a China-nexus threat actor has embedded itself in telecom networks to conduct espionage against government networks. The strategic positioning activity, which involves implanting and maintaining stealthy access mechanisms within critical environments...
Free real estate: GoPix, the banking Trojan living off your memory
Introduction GoPix is an advanced persistent threat targeting Brazilian financial institutions' customers and cryptocurrency users. It represents an evolved threat targeting internet banking users through memory-only implants and obfuscated PowerShell scripts. It evolved from the RAT and Automate...
Transparent Tribe Uses AI to Mass-Produce Malware Implants in Campaign Targeting India
The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence AI-powered coding tools to strike targets with various implants. The activity is designed to produce a "high-volume, mediocre mass of implants" that are developed...
China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks
A China-linked advanced persistent threat APT actor has been targeting critical telecommunications infrastructure in South America since 2024, targeting Windows and Linux systems and edge devices with three different implants. The activity is being tracked by Cisco Talos under the moniker UAT-924...
New threat actor, UAT-9921, leverages VoidLink framework in campaigns
Cisco Talos recently discovered a new threat actor, UAT-9921, leveraging VoidLink in campaigns. Their activities may go as far back as 2019, even without VoidLink. The VoidLink compile-on-demand feature lays down the foundations for AI-enabled attack frameworks, which can create tools on-demand f...
China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery
Cybersecurity researchers have taken the wraps off a gateway-monitoring and adversary-in-the-middle AitM framework dubbed DKnife that's operated by China-nexus threat actors since at least 2019. The framework comprises seven Linux-based implants that are designed to perform deep packet inspection...
Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework
Cisco Talos uncovered "DKnife," a fully featured gateway-monitoring and adversary-in-the-middle AitM framework comprising seven Linux-based implants that perform deep-packet inspection, manipulate traffic, and deliver malware via routers and edge devices. Based on the artifact metadata, DKnife ha...
CVE-2025-59109
The dormakaba registration units 9002 PIN Pad Units have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an...
CVE-2025-59109
The dormakaba registration units 9002 PIN Pad Units have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an...
Cloud Atlas activity in the first half of 2025: what changed
Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process CVE-2018-0802 to download and execute malicious cod...
Tomiris Shifts to Public-Service Implants for Stealthier C2 in Attacks on Government Targets
The threat actor known as Tomiris has been attributed to attacks targeting foreign ministries, intergovernmental organizations, and government entities in Russia with an aim to establish remote access and deploy additional tools. "These attacks highlight a notable shift in Tomiris's tactics, name...
Tomiris wreaks Havoc: New tools and techniques of the APT group
While tracking the activities of the Tomiris threat actor, we identified new malicious operations that began in early 2025. These attacks targeted foreign ministries, intergovernmental organizations, and government entities, demonstrating a focus on high-value political and diplomatic...
