badger-builder

badger-builder badger-builder는 동적 Brute Ratel C4 프로필을 생성하기 위한 AI 지원 도구입니다. 원하는 프로필에 대한 flavor 만 badger-builder에 제공하면 OpenAI에 적합한 구성을 요청합니다. AI로 생성되는 리스너/페이로드 프로필 구성: C2 URI 요청/응답 HTTP 헤더 C2 요청/응답에 앞/뒤에 추가되는 HTTP 본문 데이터 서버의 빈 응답empty-response HTTP 본문 HTTP 본문 데이터는 XML, JSON 또는 JavaScript로 생성할 수...

nanorobeus

Nanorobeus Kerberos 티켓을 관리하기 위한 COFF 파일BOF입니다. 지원 에이전트 Sliver Brute Ratel Cobalt Strike 명령어 luid - 현재 로그온 ID 가져오기 sessions /luid: | /all - 로그온 세션 가져오기 klist /luid: | /all - Kerberos 티켓 나열 dump /luid: | /all - Kerberos 티켓 덤프 ptt /ticket: /luid: - 로그온 세션으로 Kerberos 티켓 가져오기 purge /luid: -...

Brute-Ratel-C4-Community-Kit

Brute-Ratel-C4 이 저장소에는 Brute Ratel C4https://bruteratel.com/용 스크립트, 구성configuration 및 더 이상 사용되지 않는Deprecated 페이로드 로더가 포함되어 있습니다. deprecated 폴더에 추가된 모든 항목은 BRc4 최신 릴리스에 포함되지 않습니다...

BruteRatel-DetectionTools

BruteRatel-DetectionTools Brute Ratel C4 badger를 디코딩하기 위한 도구 및 규칙 모음 모든 도구와 규칙은 PaloAlto가 보고서 https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ 에서 식별한 샘플을 기반으로 합니다. Yara 규칙 이 Yara 규칙은 Unit42 보고서에 포함된 샘플과 이 규칙으로 추가로 식별된 샘플을 대상으로 테스트되었습니다. ❯ yara rule.yar BruteRatel ./hacker.exe BruteRatel...

⚡ Weekly Recap: Critical SAP Exploit, AI-Powered Phishing, Major Breaches, New CVEs & More

What happens when cybercriminals no longer need deep skills to breach your defenses? Today's attackers are armed with powerful tools that do the heavy lifting — from AI-powered phishing kits to large botnets ready to strike. And they're not just after big corporations. Anyone can be a target when...

Malware Attackers Using MacroPack to Deliver Havoc, Brute Ratel, and PhantomCore

Threat actors are likely employing a tool designated for red teaming exercises to serve malware, according to new findings from Cisco Talos. The program in question is a payload generation framework called MacroPack, which is used to generate Office documents, Visual Basic scripts, Windows...

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Cisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework called "MacroPack." MacroPack is a framework designated for Red Team exercises, but w...

Malware Campaign Lures Users With Fake W2 Form

The following analysts contributed to the research: Evan McCann, Matt Smith, Ipek Solak, Jake McMahon Rapid7 has recently observed an campaign targeting users searching for W2 forms using the Microsoft search engine Bing. Users are subsequently directed to a fake IRS website, enticing them to...

Patchwork Hackers Target Bhutan with Advanced Brute Ratel C4 Tool

The threat actor known as Patchwork has been linked to a cyber attack targeting entities with ties to Bhutan to deliver the Brute Ratel C4 framework and an updated version of a backdoor called PGoShell. The development marks the first time the adversary has been observed using the red teaming...

Researchers Discover New PlugX Malware Variant Spreading via Removable USB Devices

Cybersecurity researchers have uncovered a PlugX sample that employs sneaky methods to infect attached removable USB media devices in order to propagate the malware to additional systems. "This PlugX variant is wormable and infects USB devices in such a way that it conceals itself from the Window...

Quarterly Report: Incident Response Trends in Q3 2022

Ransomware and pre-ransomware engagements make up 40 percent of threats seen this quarter By Caitlin Huey. For the first time since compiling these reports, Cisco Talos Incident Response saw an equal number of ransomware and pre-ransomware engagements, making up nearly 40 percent of threats this...

Black Basta Ransomware Hackers Infiltrate Networks via Qakbot to Deploy Brute Ratel C4

The threat actors behind the Black Basta ransomware family have been observed using the Qakbot trojan to deploy the Brute Ratel C4 framework as a second-stage payload in recent attacks. The development marks the first time the nascent adversary simulation software is being delivered via a Qakbot...

Black Basta Ransomware Gang Infiltrates networks via QAKBOT, Brute Ratel, and Cobalt Strike

We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware...

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware...

Hackers Abusing BRc4 Red Team Penetration Tool in Attacks to Evade Detection

Malicious actors have been observed abusing legitimate adversary simulation software in their attacks in an attempt to stay under the radar and evade detection. Palo Alto Networks Unit 42 said a malware sample uploaded to the VirusTotal database on May 19, 2022, contained a payload associated wit...