bat

Behavioral Adversary Tracer BAT BAT 是一个真实且不断演进的针对 Linux 和 Windows 的对手威胁模型。它不是 C2 框架，也不是 rootkit。它是一个完整的威胁模拟平台，将 C2 通信、内核级隐密 rootkit 模块、用户空间规避、权限提升、持久化、进程注入、凭据收集、数据外泄和横向移动集成到一个单一的、有凝聚力的对手模型中。设计目标是成为 2026 年最复杂、最真实的 Linux 威胁，独立于任何检测系统当前能捕获的内容。 它是一个研究配对中的对手方。Aura 框架进化以检测 Bat。Bat 进化以规避...

bunitu_tests

bunitutests 用于与Bunitu木马C&C通信的脚本 自行承担使用风险！ 作者： : hasherezade Malwarebytes : Sergei Frankoff Sentrant 文件： cnc1test.py - 将你的主机注册为Bunitu僵尸网络中的代理僵尸（与C&C1通信） cnc2test.py - 检查给定主机是否为Bunitu隧道C&C（与C&C2通信） 如何使用这些脚本：https://github.com/hasherezade/bunitutests/wiki...

AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis

1. Conexiones de red y configuración SSL/TLS El análisis de memoria de Process Hacker revela que AcrStealer establece conexiones de red mediante SSL/TLS para comunicarse de forma segura con su servidor C2. Observaciones clave: SslClientCert – Utiliza certificados de cliente para la autenticación...

MAL-2026-14387 Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

MAL-2026-14380 Malicious code in fund-list-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb78208f7aa932298e92a8c241ed970296c567a273fc21013dd83bb7916e81b On npm install, package.json's preinstall hook runs index.js which harvests installer host identifiers — os.hostname, os.userInfo username, local IPv...

Malicious code in proc_macro1 (crates.io)

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...

Malicious code in @oyo_tech/oyochat_user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e @oyotech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e...

centipede

centipede Self-replicating Linux worm framework with multi-la...

MAL-2026-1290 Malicious code in remjsonparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e478d1e016f1d6d6d1cb4a9d23ac45449c22d99aa8e71c88d2f38fae8951f23f During import, package starts advanced compromise actions: exfiltrates AWS and git credentials, commands history, security tools in use. After that, the code...

QSC: A multi-plugin framework used by CloudComputating group in cyberespionage campaigns

Introduction In 2021, we began to investigate an attack on the telecom industry in South Asia. During the investigation, we discovered QSC: a multi-plugin malware framework that loads and runs plugins modules in memory. The framework includes a Loader, a Core module, a Network module, a Command...

Cybercriminals Exploit Popular Software Searches to Spread FakeBat Malware

Cybersecurity researchers have uncovered a surge in malware infections stemming from malvertising campaigns distributing a loader called FakeBat. "These attacks are opportunistic in nature, targeting users seeking popular business software," the Mandiant Managed Defense team said in a technical...

Russian APT Deploys New 'Kapeka' Backdoor in Eastern European Attacks

A previously undocumented "flexible" backdoor called Kapeka has been "sporadically" observed in cyber attacks targeting Eastern Europe, including Estonia and Ukraine, since at least mid-2022. The findings come from Finnish cybersecurity firm WithSecure, which attributed the malware to the...

Vultur Android Banking Trojan Returns with Upgraded Remote Control Capabilities

The Android banking trojan known as Vultur has resurfaced with a suite of new features and improved anti-analysis and detection evasion techniques, enabling its operators to remotely interact with a mobile device and harvest sensitive data. "Vultur has also started masquerading more of its...

Hackers Exploit ConnectWise ScreenConnect Flaws to Deploy TODDLERSHARK Malware

North Korean threat actors have exploited the recently disclosed security flaws in ConnectWise ScreenConnect to deploy a new malware called TODDLERSHARK. According to a report shared by Kroll with The Hacker News, TODDLERSHARK overlaps with known Kimsuky malware such as BabyShark and ReconShark...

U.S. DoJ Dismantles Warzone RAT Infrastructure, Arrests Key Operators

The U.S. Justice Department DoJ on Friday announced the seizure of online infrastructure that was used to sell a remote access trojan RAT called Warzone RAT. The domains – www.warzone.ws and three others – were "used to sell computer malware used by cybercriminals to secretly access and steal dat...

New NKAbuse Malware Exploits NKN Blockchain Tech for DDoS Attacks

A novel multi-platform threat called NKAbuse has been discovered using a decentralized, peer-to-peer network connectivity protocol known as NKN short for New Kind of Network as a communications channel. "The malware utilizes NKN technology for data exchange between peers, functioning as a potent...

Free Download Manager backdoored – a possible supply chain attack on Linux machines

UPDATE 13.09.2023. Free Download Manager team issued an official statement regarding this incident. Over the last few years, Linux machines have become a more and more prominent target for all sorts of threat actors. According to our telemetry, 260,000 unique Linux samples appeared in the first...

Unmasking Decoy Dog Malware Toolkit Hiding in DNS Traffic

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Decoy Dog, a sophisticated malware toolkit uses DNS for C2 communication, evading detection with its wildcard-type behavior and encryption methods. Its origin remains mysterious, and the malwares...

New PowerExchange Backdoor Used in Iranian Cyber Attack on UAE Government

An unnamed government entity associated with the United Arab Emirates U.A.E. was targeted by a likely Iranian threat actor to breach the victim's Microsoft Exchange Server with a "simple yet effective" backdoor dubbed PowerExchange. According to a new report from Fortinet FortiGuard Labs, the...

PY#RATION: New Python-based RAT Uses WebSocket for C2 and Data Exfiltration

Cybersecurity researchers have unearthed a new attack campaign that leverages a Python-based remote access trojan RAT to gain control over compromised systems since at least August 2022. "This malware is unique in its utilization of WebSockets to avoid detection and for both command-and-control C...