DoH_c2_Trigger

DoHc2Trigger Code für Blogbeitrag: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/...

GOXLR-malware-family

Dieses Repository war ursprünglich meine Analyse und mein Bericht über Malware, die auf goxlr.net gefunden wurde. Kürzlich entdeckte ich, dass sie AUCH mehrere andere Malware-Domains mit verschiedenen Malware-Varianten betrieben, bisher alles Stealer, und alle sind ein Klon von "goxlr". Deshalb...

fronthunter

FrontHunter FrontHunter è uno strumento per testare grandi liste di domini per identificare candidati per il domain fronting. Domain Fronting? Davvero? Lo so, lo so… il domain fronting è piuttosto vecchio. Ma la verità è che è ancora utile come un'altra funzionalità da includere nella tua...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

BounceBack

BounceBack ↕️🤫 Redirect stealth per la sicurezza delle operazioni del tuo team red. Panoramica BounceBack è un potente proxy inverso altamente personalizzabile e configurabile con funzionalità WAF per nascondere la tua infrastruttura C2/phishing/ecc. ai team blu, sandbox, scanner, ecc. Utilizza...

ycsm

You Can't See Me YCSM यह nginx रिवर्स प्रॉक्सी और letsencrypt का उपयोग करके एक लचीले रिडायरेक्टर के लिए त्वरित स्क्रिप्ट इंस्टॉलेशन है, जो कुछ लोकप्रिय RATS Cobalt Strike, Empire, Metasploit के साथ संगत है। यदि HTTPS चुना गया था, तो यह स्वचालित रूप से letsencrypt certbot सेटअप करेगा और आपके...

BitLock-Crypto-Research

🛡️ BitLock Framework: Ecosistema di Crittovirologia e C2 PoC Questo repository contiene una Proof of Concept PoC completa progettata per lo studio delle architetture di minacce moderne. Il progetto simula un ambiente di attacco fileless senza file con un'infrastruttura di comando e controllo C2...

GithubC2

GithubC2 Github als C2-Demonstration, kostenlose API = kostenlose C2-Infrastruktur Demo https://user-images.githubusercontent.com/110354855/192076474-3c1884f8-4a59-4944-b0d6-9dc59c7692f0.mp4...

AutoFunkt

AutoFunkt root@kitploit: d8888 888 8888888888 888 888 d88888 888 888 888 888 d88P888 888 888 888 888 d88P 888 888 888 888888 .d b. 8888888 888 888 88888b. 888 888 888888 d88P 888 888 888 888 d88 88b 888 888 888 888 "88b 888 .88P 888 d88P 888 888 888 888 888 888 888 888 888 888888K 888 d8888888888...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. Infrastruttura C2 – Server Resilienti e Ridondanti L'analisi della memoria di Process Hacker rivela un elenco completo di domini utilizzati dal Dropper GCleaner per la comunicazione C2. Questi domini sono ospitati su varie piattaforme Scaleway, Render, Replit, ecc., indicando un'infrastruttura...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

Malicious code in @marketfront/baobabtech (npm)

The @marketfront/baobabtech package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6786 Malicious code in @marketfront/mychatspreloader (npm)

The @marketfront/mychatspreloader package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and us...

MAL-2026-6772 Malicious code in @marketfront/customdealsfeed (npm)

The @marketfront/customdealsfeed package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-5164 Malicious code in @emcd-vue/b2b-pay-form (npm)

Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to distribute multiple malicious packages posing as internal tooling under the "EMCD Platform...

New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations

Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations NGOs and suspected universities to deliver a newly identified malware family, "LucidRook." LucidRook is a sophisticated stager that embeds a Lua...

New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys

Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent. The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs researcher SangRyol Ryu said in an...

Living off the land with Bluetooth PAN

TL:DR Bluetooth is enabled by default on the majority of Windows laptops Bluetooth PAN can be used to bridge connections locally between a client laptop and attacking device Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is accessible to...

Warning: Markopolo's Scam Targeting Crypto Users via Fake Meeting Software

A threat actor who goes by alias markopolo has been identified as behind a large-scale cross-platform scam that targets digital currency users on social media with information stealer malware and carries out cryptocurrency theft. The attack chains involve the use of a purported virtual meeting...