WEASEL

WEASEL：一种隐蔽的DNS信标 WEASEL是一个小型内存植入程序，使用Python 3，无依赖项。信标客户端会向其控制的DNS区域发送少量主机标识信息。WEASEL服务器可以任务化客户端执行预制或任意命令。 WEASEL是一个阶段1有效载荷，旨在难以检测，并在你那些嘈杂的全功能阶段被捕获时用于重新获得访问权限。 状态 已在操作中成功使用并规避了检测。 客户端可以与服务器建立会话并建立双向通信。 服务器拥有完全可用的CLI。 客户端支持服务器可以任务化的多个功能。 经过压缩+混淆后，客户端大小为5.2KB。 自动混淆功能不足，需要手动修复（参见客户端README中的限制）。...

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a...

Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware

The threat actor known as Confucius has been attributed to a new phishing campaign that has targeted Pakistan with malware families like WooperStealer and Anondoor. "Over the past decade, Confucius has repeatedly targeted government agencies, military organizations, defense contractors, and...