nanorobeus

Nanorobeus 用于管理 Kerberos 票据的 COFF 文件（BOF）。 支持的代理 Sliver Brute Ratel Cobalt Strike 命令 luid - 获取当前登录 ID sessions /luid: | /all - 获取登录会话 klist /luid: | /all - 列出 Kerberos 票据 dump /luid: | /all - 导出 Kerberos 票据 ptt /ticket: /luid: - 将 Kerberos 票据导入登录会话 purge /luid: - 清除 Kerberos 票据 tgtdeleg /spn:...

Brute-Ratel-C4-Community-Kit

Brute-Ratel-C4 本仓库包含用于 Brute Ratel C4 https://bruteratel.com/ 的脚本、配置和已弃用的 payload 加载器。添加到 deprecated 文件夹中的任何内容都不会包含在 BRc4 的最新版本中。...

BruteRatel-DetectionTools

BruteRatel-DetectionTools 一个用于解码 Brute Ratel C4 badger 的工具和规则集合 所有工具和规则均基于 PaloAlto 在其报告 https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ 中识别的样本 Yara 规则 该 Yara 规则已针对 Unit42 报告中包含的样本以及由该规则识别出的其他样本进行了测试 root@kitploit: ❯ yara rule.yar BruteRatel ./hacker.exe BruteRatel ./badgerx64.exe...

badger-builder

badger-builder badger-builder 是一个用于生成动态 Brute Ratel C4 配置文件的 AI 辅助工具。只需为 badger-builder 提供一个你所需配置文件的 风格（flavor） ，它就会向 OpenAI 提示以获取合适的配置。 由 AI 生成的监听器/载荷配置文件： C2 URI 请求/响应 HTTP 头部 附加在 C2 请求/响应之前和之后的 HTTP 正文数据 服务器的 空响应 HTTP 正文 HTTP 正文数据可以以 XML、JSON 或 JavaScript 生成（并且请求格式可以与响应格式不同）。 我始终建议检查 OpenAI...

⚡ Weekly Recap: Critical SAP Exploit, AI-Powered Phishing, Major Breaches, New CVEs & More

What happens when cybercriminals no longer need deep skills to breach your defenses? Today's attackers are armed with powerful tools that do the heavy lifting — from AI-powered phishing kits to large botnets ready to strike. And they're not just after big corporations. Anyone can be a target when...

Malware Attackers Using MacroPack to Deliver Havoc, Brute Ratel, and PhantomCore

Threat actors are likely employing a tool designated for red teaming exercises to serve malware, according to new findings from Cisco Talos. The program in question is a payload generation framework called MacroPack, which is used to generate Office documents, Visual Basic scripts, Windows...

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Cisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework called "MacroPack." MacroPack is a framework designated for Red Team exercises, but w...

Malware Campaign Lures Users With Fake W2 Form

The following analysts contributed to the research: Evan McCann, Matt Smith, Ipek Solak, Jake McMahon Rapid7 has recently observed an campaign targeting users searching for W2 forms using the Microsoft search engine Bing. Users are subsequently directed to a fake IRS website, enticing them to...

Patchwork Hackers Target Bhutan with Advanced Brute Ratel C4 Tool

The threat actor known as Patchwork has been linked to a cyber attack targeting entities with ties to Bhutan to deliver the Brute Ratel C4 framework and an updated version of a backdoor called PGoShell. The development marks the first time the adversary has been observed using the red teaming...

Researchers Discover New PlugX Malware Variant Spreading via Removable USB Devices

Cybersecurity researchers have uncovered a PlugX sample that employs sneaky methods to infect attached removable USB media devices in order to propagate the malware to additional systems. "This PlugX variant is wormable and infects USB devices in such a way that it conceals itself from the Window...

Quarterly Report: Incident Response Trends in Q3 2022

Ransomware and pre-ransomware engagements make up 40 percent of threats seen this quarter By Caitlin Huey. For the first time since compiling these reports, Cisco Talos Incident Response saw an equal number of ransomware and pre-ransomware engagements, making up nearly 40 percent of threats this...

Black Basta Ransomware Hackers Infiltrate Networks via Qakbot to Deploy Brute Ratel C4

The threat actors behind the Black Basta ransomware family have been observed using the Qakbot trojan to deploy the Brute Ratel C4 framework as a second-stage payload in recent attacks. The development marks the first time the nascent adversary simulation software is being delivered via a Qakbot...

Black Basta Ransomware Gang Infiltrates networks via QAKBOT, Brute Ratel, and Cobalt Strike

We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware...

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware...

Hackers Abusing BRc4 Red Team Penetration Tool in Attacks to Evade Detection

Malicious actors have been observed abusing legitimate adversary simulation software in their attacks in an attempt to stay under the radar and evade detection. Palo Alto Networks Unit 42 said a malware sample uploaded to the VirusTotal database on May 19, 2022, contained a payload associated wit...