Angry Birds: Toy Ghouls’ new toys

Introduction We continue tracking the activity of Toy Ghouls also known as Bearlyfy, Laboo.boo, and Feral Wolf, a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along...

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

In this article 1. Risk to enterprise environments 2. Attack chain overview 3. Mitigation and response recommendations 4. Learn more Microsoft Threat Intelligence has observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk...

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

In this article 1. Risk to enterprise environments 2. Attack chain overview 3. Mitigation and response recommendations 4. Learn more Microsoft Threat Intelligence has observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or helpdesk...

Windows Remote Management - Detection

Detects Windows Remote Management WinRM by checking HTTP response headers on ports 5985 HTTP and 5986 HTTPS. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Windows Remote Management WinRM by checking HTTP response headers on ports 5985 HTTP and 5986 HTT.""" import re from kittysploit import...

WinRM Download File

Download a remote file through an active WinRM session pypsrp fetch !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Download File",...

WinRM Spawn Reverse Shell

From the current WinRM session, open a reverse TCP listener lhost:lport and run a PowerShell stager so the target connects back as a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Spawn a reverse TCP shell from an existing WinRM session. Starts a local reverse handler, runs a...

WinRM Lateral Movement

Authenticate to a remote host via WinRM using supplied credentials or credentials from the current session metadata and open a new WinRM session. !/usr/bin/env python3 -- coding: utf-8 -- """ Pivot from an existing WinRM session or supplied credentials to another Windows host over WinRM and...

WinRM Gather PowerShell History

Read PSReadLine ConsoleHosthistory.txt files through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather PowerShell History...

WinRM Gather Network

Enumerate network interfaces, routes, DNS, ARP, connections, and shares through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Gather Network", "description": "Enumerate network interfaces, routes, DNS, ARP, connections, a...

WinRM Upload File

Upload a local file to the remote host through an active WinRM session pypsrp copy !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Upload File...

WinRM PowerShell Exec

Execute a PowerShell command or script through an active WinRM session !/usr/bin/env python3 -- coding: utf-8 -- import base64 from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM PowerShell Exec",...

WinRM Persistence Scheduled Task

Create a scheduled task persistence entry through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Scheduled Task",...

WinRM Gather Users

Enumerate current user, local users/groups, and interactive sessions through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Gather Users", "description": "Enumerate current user, local users/groups, and interactive session...

WinRM Gather RDP Files

Find and parse saved .rdp client files through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather RDP Files", "description...

WinRM Persistence Service

Create, start, or remove a Windows service for persistence via WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Service", "description"...

WinRM Gather WiFi Keys

Extract saved WLAN profile PSKs via netsh over a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather WiFi Keys", "description...

WinRM Config Audit

Audit local WinRM service configuration, listeners, authentication, and TrustedHosts !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Config Audit", "description": "Audit local WinRM service configuration, listeners, authentication, and...

WinRM Gather PuTTY WinSCP FileZilla

Collect PuTTY, WinSCP, and FileZilla saved sessions through WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather PuTTY WinSCP...

WinRM Gather VPN Profiles

List VPN connections and rasphone.pbk phonebooks through WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather VPN Profiles",...

WinRM Persistence Run Key

Add or remove a Run/RunOnce registry persistence entry via WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Run Key", "description": "A...