VeeamDumper-BOF

Veeam Dumper BOF Un BOF per l'estrazione di credenziali per Veeam Backup and Replication e Veeam One di Stephen Munro e Logan Kroeger di @MWRCyberSec. Il BOF deve essere eseguito in un beacon Admin su un server Veeam One o Veeam Backup and Replication e supporta Cobalt Strike e Outflank C2...

CVE-2002-0347

CVE-2002-0347 ثغرة اجتياز الدليل في Cobalt RAQ 4 تسمح للمهاجمين عن بُعد بقراءة الملفات المحمية بكلمة مرور، وربما الملفات خارج جذر الويب، عبر .. نقطتان في طلب HTTP. منشور Packetstorm على https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html منشور SecurityFocus على...

SauronEye

SauronEye SauronEye è uno strumento di ricerca progettato per aiutare i red team a trovare file contenenti parole chiave specifiche. Caratteristiche : Cerca più unità di rete Cerca il contenuto dei file Cerca il contenuto di file Microsoft Office .doc, .docx, .xls, .xlsx Trova macro VBA nei vecch...

BokuLoader

BokuLoader : Cobalt Strike Reflective Loader Una proof-of-concept di User-Defined Reflective Loader UDRL che mira a ricreare, integrare e potenziare le funzionalità di evasione di Cobalt Strike! Contributori:...

cs-get-last-error

cs-get-last-error Ottieni i messaggi di errore dai codici di GetLastError direttamente all'interno del client Cobalt Strike senza l'aiuto di Google search, net helpmsg o Microsoft Error Lookup Tool. I messaggi di errore sono inclusi nell'aggressor script e non è richiesta alcuna interazione con i...

Burp2Malleable

Burp2Malleable Schnelles Python-Dienstprogramm, das ich geschrieben habe, um HTTP-Anfragen aus Burp Suite in Cobalt Strike Malleable C2-Profile umzuwandeln. Damit kannst du abgefangene/erstellte Anfragen aus BurpSuite oder ZAP, POSTMAN usw. nehmen, die festlegen, wie dein Datenverkehr aussehen bz...

dissect.cobaltstrike

Cobalt Strike mit Python analysieren .. image:: https://github.com/fox-it/dissect.cobaltstrike/workflows/Tests/badge.svg :target: https://github.com/fox-it/dissect.cobaltstrike/actions :alt: GitHub Actions status .. image:: https://readthedocs.org/projects/dissect-cobaltstrike/badge/?version=late...

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark , said the...

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

Introduction During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previously undocumented malware family that we have named SharkLoader. What initially appeared to be an isolated case quickly expanded into a broader campaign as we identified additional...

CVE-2025-65087

An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed...

KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike

A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System LMS popular in Japan, was exploited as a zero-day to deliver the Godzilla web shell and ultimately facilitate the deployment of Cobalt Strike Beacon. The vulnerability, tracked as...

MS16-032-Cobalt-Strike-LPE-BOF

MS16-032 Beacon Object File BOF A Cobalt Strike Beacon Obje...

Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware

The Belarus-aligned threat actor known as Ghostwriter aka UAC-0057 and UNC1151 has been observed using lures related to Prometheus, a Ukrainian online learning platform, to target government organizations in the country. The activity, per the Computer Emergency Response Team of Ukraine CERT-UA,...

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine. Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particular...

EUVD-2025-209808

An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed...

EUVD-2025-209805

An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to execute arbitrary code when a specially crafted VC6 file is being parsed...

CVE-2025-65086

An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to execute arbitrary code when a specially crafted VC6 file is being parsed...

CVE-2025-65088

An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed...

CVE-2025-65087

An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed...

CVE-2025-65087 Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed...