cnc-relay

cnc-relay 在红队演练中，通常会搭建中继（relay）基础设施，将对外暴露的足迹与实际命令与控制（C2）后端分离开来。一些常见的轻量级方案是在临时云基础设施上部署 HAProxy 或 NGINX，并将流量代理到内部和/或受保护的主机，操作员可在此主机上访问命令与控制框架。尽管这种设置大多时候有效，但信标（beacon）的原始源 IP 等元数据会丢失。 本仓库包含两个 Docker 环境，允许你搭建一个带中继的示例命令与控制环境，同时仍能保留信标的原始源...

Experts Identify 3 Chinese-Linked Clusters Behind Cyberattacks in Southeast Asia

A trio of threat activity clusters linked to China has been observed compromising more government organizations in Southeast Asia as part of a renewed state-sponsored operation codenamed Crimson Palace, indicating an expansion in the scope of the espionage effort. Cybersecurity firm Sophos, which...