PingRAT

PingRAT PingRAT transmet secrètement le trafic C2 à travers les pare-feu en utilisant les charges utiles ICMP. Fonctionnalités : Utilise ICMP pour le commandement et le contrôle Indétectable par la plupart des solutions AV/EDR Écrit en Go Installation : Télécharger les binaires ou construisez les...

flightsim

Simulateur de vol réseau flightsim est un utilitaire léger utilisé pour générer du trafic réseau malveillant et aider les équipes de sécurité à évaluer les contrôles de sécurité et la visibilité réseau. L'outil effectue des tests pour simuler le tunneling DNS, le trafic DGA, les requêtes vers des...

doublepulsar-c2-traffic-decryptor

Автор: Luke Jennings [email protected] – @jukelennings Компания: Countercept @countercept Веб-сайт: https://countercept.com Скрипт на python2 для расшифровки C2-трафика, используемого имплантом DOUBLEPULSAR SMB, из файла PCAP. Шифрование представляет собой простой 4-байтовый XOR, который час...

CobaltBus

CobaltBus Intégration C2 externe de Cobalt Strike avec Azure Servicebus, trafic C2 via Azure Servicebus Configuration 1. Créez un Azure Service Bus 2. Créez une stratégie d'accès partagé chaîne de connexion qui ne peut qu'envoyer et écouter 3. Modifiez la variable statique connectionString dans l...

ramnit_traffic_parser

ramnittrafficparser Если у вас есть трафик между Ramnit и C2, вы можете извлечь конфиги и модули Требования PHP 7 tshark Использование root@kitploit: $ php main.php pcap/URL Пример root@kitploit: $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" +...

C2-Hunter

C2-Hunter C2-Hunter est un programme conçu pour les analystes de malwares afin d'extraire le trafic de commande et contrôle C2 des malwares en temps réel. Le programme utilise une approche unique en s'accrochant aux API de connexions win32. Avec C2-Hunter, les analystes de malwares peuvent...

loki-parse

loki-parse loki-bot악성코드과 관련된, 손상된 호스트와 C2 서버 간의 네트워크 트래픽을 탐지하고 파싱하는 Python 스크립트입니다. 이 스크립트는 C2로 유출되는 데이터가 무엇인지, 봇 추적 등을 알고 싶어하는 DFIR 분석가와 보안 연구자에게 유용할 수 있습니다. 이 스크립트는 스위치 없이 네트워크에서 직접 스니핑하거나--pcap $pcapfile 사용 네트워크 트래픽의 PCAP을 읽을 수 있습니다. 스크립트가 loki-bot 관련 네트워크 트래픽을 탐지하면 패킷에 포함된 데이터를 JSON 형식으로 화면에...

Red-Team-Infrastructure-Wiki

Эта вики предназначена для предоставления ресурса по настройке устойчивой инфраструктуры Red Team. Она была создана в дополнение к докладу Стива Бороша @424f424f и Джеффа Диммока @bluscreenofjeff на BSides NoVa 2017 «Doomsday Preppers: Fortifying Your Red Team Infrastructure» слайды Если вы хотит...

Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025. "PowMix employs randomized command-and-control C2 beaconing intervals, rather than persisten...

New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication

Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service BITS as a command-and-control C2 mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Lab...

RedditC2 - Abusing Reddit API To Host The C2 Traffic, Since Most Of The Blue-Team Members Use Reddit, It Might Be A Great Way To Make The Traffic Look Legit

Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.  Disclaimer: Use of this project is for Educational/Testing purposes only. Using it on unauthorised machines is strictly forbidden. If somebody is...

Denonia cryptominer is first malware to target AWS Lambda

Security researchers at Cado Security, a cybersecurity forensics company, recently discovered the first publicly-known malware targeting Lambda, the serverless computing platform of Amazon Web Services AWS. Though Lambda has been around for less than ten years, serverless technology is considered...

CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 Traffic Via Azure Servicebus

Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus Setup 1. Create an Azure Service Bus 2. Create a Shared access policy Connection string that can only Send and Listen 3. Edit the static connectionString variable in Beacon C projects to match the "Primar...

Ryuk, Egregor Ransomware Attacks Leverage SystemBC Backdoor

Commodity malware backdoor SystemBC has evolved to now automate a number of key activities, as well as use the anonymizing Tor platform. These overarching changes make it both easier for cybercriminals to deploy the backdoor, as well as cloak the destination of the command-and-control C2 traffic...

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

Executive Summary We have discovered a global intrusion campaign. We are tracking the actors behind this campaign as UNC2452. FireEye discovered a supply chain attack trojanizing SolarWinds Orion business software updates in order to distribute malware we call SUNBURST. The attacker’s post...

Our Experiences Participating in Microsoft’s Azure Sphere Bounty Program | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

CSI: Evidence Indicators for Targeted Ransomware Attacks - Part II | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

DOUBLEPULSAR - Payload Execution and Neutralization Exploit

This Metasploit module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE. While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant. This...

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DOUBLEPULSAR Payload Execution and Neutralization', 'Description' = %q This module executes a Metasploit payload against the Equation Group's...

DOUBLEPULSAR Payload Execution / Neutralization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DOUBLEPULSAR Payload Execution and Neutralization', 'Description' = %q This module executes a Metasploit payload against the Equation Group's...