redi

redi Configuración automatizada de redireccionador compatible con RATs HTTP CobaltStrike Beacon, meterpreter, etc. y CobaltStrike DNS Beacon. El script puede configurar un proxy inverso nginx o un proxy/reenviador DNS usando dnsmasq. Si se selecciona HTTPS, configurará automáticamente letsencrypt...

BeaconEye

BeaconEye 介绍 BeaconEye 扫描正在运行的进程以查找活跃的 CobaltStrike 信标。当发现进程在运行信标时，BeaconEye 将监控每个进程的 C2 活动。 工作原理 BeaconEye 将扫描实时进程或 MiniDump 文件以查找可疑的 CobaltStrike 信标。在实时进程模式下，BeaconEye 可选择将其自身附加为调试器，并开始监控信标的 C2 流量活动（目前支持 HTTP/HTTPS 信标）。 用于加密 C2 数据和可变配置文件的 AES 密钥会在运行时解码，这使得 BeaconEye 能够在操作员发送命令时提取并解密信标的输出。...

New UAC-0056 activity: There’s a Go Elephant in the room

This blog post was authored by Ankur Saini, Roberto Santos and Hossein Jazi. UAC-0056 also known as SaintBear, UNC2589 and TA471 is a cyber espionage actor that has been active since early 2021 and has mainly targeted Ukraine and Georgia. The group is known to have performed a wiper attack in...