CobaltBus

CobaltBus Cobalt Strike와 Azure Servicebus 간의 External C2 통합, Azure Servicebus를 통한 C2 트래픽 설정 1. Azure Service Bus 생성 2. 보내기 및 수신만 가능한 공유 액세스 정책연결 문자열 생성 3. Beacon C 프로젝트의 static connectionString 변수를 2단계에서 생성한 공유 액세스 정책의 'Primary Connection String' 값과 일치하도록 수정합니다. 4. CobaltBus 프로젝트에도 동일한 변수를 업데이트해야...

PingRAT

PingRAT PingRAT은 ICMP 페이로드를 사용하여 방화벽을 통해 C2 트래픽을 은밀하게 전달합니다. 기능: ICMP를 사용한 명령 및 제어 대부분의 AV/EDR 솔루션에서 탐지 불가 Go로 작성됨 설치: 다운로드 바이너리 또는 바이너리를 빌드하면 바로 사용할 수 있습니다: root@kitploit: $ git clone https://github.com/umutcamliyurt/PingRAT.git $ go build client.go $ go build server.go 사용법: 서버: root@kitploit:...

flightsim

네트워크 비행 시뮬레이터 flightsim 은 보안 팀이 보안 통제 및 네트워크 가시성을 평가할 수 있도록 악성 네트워크 트래픽을 생성하는 경량 유틸리티입니다. 이 도구는 DNS 터널링, DGA 트래픽, 알려진 활성 C2 대상으로의 요청 및 기타 의심스러운 트래픽 패턴을 시뮬레이션하는 테스트를 수행합니다. 설치 GitHub Releases 페이지에서 OS에 맞는 최신 flightsim 바이너리를 다운로드하세요. 또는 Golang을 사용하여 모든 환경예: Linux, MacOS, Windows에서 다음과 같이 유틸리티를 빌드할 ...

doublepulsar-c2-traffic-decryptor

著者: Luke Jennings [email protected] - @jukelennings 会社: Countercept @countercept ウェブサイト: https://countercept.com PCAPファイルからDOUBLEPULSAR...

C2-Hunter

C2-Hunter C2-Hunter는 악성코드 분석가가 실시간으로 악성코드의 명령 및 제어C2 트래픽을 추출하도록 설계된 프로그램입니다. 이 프로그램은 win32 연결 API에 후킹하는 독특한 접근 방식을 사용합니다. C2-Hunter를 통해 악성코드 분석가들은 이제 실시간으로 통신을 차단하고 분석하여 사이버 위협의 내부 동작에 대한 귀중한 통찰력을 얻을 수 있습니다. 악성코드의 C2 요소를 추적하는 기능은 모든 사이버 보안 팀에 필수적인 도구입니다. 특징 C2 트래픽 실시간 추출 악성코드 시간 지연을 우회하여 추출 속도 향상...

ramnit_traffic_parser

ramnittrafficparser Ramnit と C2 間のトラフィックデータがあれば、設定とモジュールをダンプできます。 必要なもの PHP 7 tshark 使い方 root@kitploit: $ php main.php pcap/URL 例 root@kitploit: $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" + REGISTERBOT0xe2 : output/00e2.bin + REGISTERBOT0xe2 ...

Red-Team-Infrastructure-Wiki

このWikiは、堅牢なRed Teamインフラストラクチャを構築するためのリソースを提供することを目的としています。Steve Borosh（@424f424f）とJeff Dimmock（@bluscreenofjeff）によるBSides NoVa 2017の講演「Doomsday Preppers: Fortifying Your Red Team Infrastructure」（スライド）を補完するために作成されました。 追加したい内容がある場合は、Pull Requestを送信するか、リポジトリにIssueを登録してください。...

loki-parse

loki-parse Pythonスクリプトで、感染ホストとC2サーバー間のloki-bot（マルウェア）に関連するネットワークトラフィックを検出・解析します。このスクリプトは、C2にどのデータが流出しているのか、ボットの追跡などを把握したいDFIRアナリストやセキュリティ研究者にとって有用です。 このスクリプトは、直接ネットワーク上のパケットをキャプチャする（スイッチなし）か、PCAPファイルのネットワークトラフィックを読み込む（--pcap $pcapfile...

Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. "PowMix employs randomized command-and-control C2 beaconing intervals, rather than persisten...

New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication

Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service BITS as a command-and-control C2 mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Lab...

RedditC2 - Abusing Reddit API To Host The C2 Traffic, Since Most Of The Blue-Team Members Use Reddit, It Might Be A Great Way To Make The Traffic Look Legit

Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.  Disclaimer: Use of this project is for Educational/Testing purposes only. Using it on unauthorised machines is strictly forbidden. If somebody is...

Denonia cryptominer is first malware to target AWS Lambda

Security researchers at Cado Security, a cybersecurity forensics company, recently discovered the first publicly-known malware targeting Lambda, the serverless computing platform of Amazon Web Services AWS. Though Lambda has been around for less than ten years, serverless technology is considered...

CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 Traffic Via Azure Servicebus

Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match the "Primar...

Ryuk, Egregor Ransomware Attacks Leverage SystemBC Backdoor

Commodity malware backdoor SystemBC has evolved to now automate a number of key activities, as well as use the anonymizing Tor platform. These overarching changes make it both easier for cybercriminals to deploy the backdoor, as well as cloak the destination of the command-and-control C2 traffic...

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

Executive Summary We have discovered a global intrusion campaign. We are tracking the actors behind this campaign as UNC2452. FireEye discovered a supply chain attack trojanizing SolarWinds Orion business software updates in order to distribute malware we call SUNBURST. The attacker’s post...

Our Experiences Participating in Microsoft’s Azure Sphere Bounty Program | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

CSI: Evidence Indicators for Targeted Ransomware Attacks - Part II | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

DOUBLEPULSAR - Payload Execution and Neutralization Exploit

This Metasploit module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE. While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant. This...

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DOUBLEPULSAR Payload Execution and Neutralization', 'Description' = %q This module executes a Metasploit payload against the Equation Group's...

DOUBLEPULSAR Payload Execution / Neutralization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DOUBLEPULSAR Payload Execution and Neutralization', 'Description' = %q This module executes a Metasploit payload against the Equation Group's...