w2.js: Malicious JavaScript Payload in BdThemes Supply Chain Attack
w2.js is a JavaScript payload used in the BdThemes supply chain attack. It contacts a C2 server, creates rogue admin accounts, installs…
Tag: C2
PhantomGraph: Backdoor with OneDrive C2
PhantomGraph is a backdoor that shares code overlap with PhantomCore. It consists of two DLL modules: SysExcSvc.dll for receiving commands and exfiltrating…
HelloProxy: Hidden Proxy and Loader
HelloProxy is a hidden proxy and loader used in the HelloNet attack. It loads additional modules from a C2 server and interferes…
HelloBackdoor: Rust Implant for File Transfer and Command Execution
HelloBackdoor is a Rust-based implant discovered in systems infected by the HelloNet attack. It enables file uploads and downloads to and from…
Sliver C2 Framework Deployed via Malicious npm Packages
Sliver, an open-source command-and-control (C2) framework, is deployed as the final payload on Linux systems in the malicious npm campaign. The Linux…
ENDLESSDOORS: The Factory-Ship Backdoor in Zbtlink Routers
ENDLESSDOORS is a backdoor implant found in Zbtlink router firmware. It is based on the rctl tool and allows unauthenticated remote attackers…
rctl: The Open-Source Tool Behind ENDLESSDOORS
rctl (remote control linux) is a simple command and control client/server tool uploaded to GitHub in 2015. It listens on port 7000…
NullReceiver: A New Ethereum-Based C2 Technique
NullReceiver is a novel command-and-control (C2) technique that encodes the C2 server IP address within the recipient address of a zero-value Ethereum…
EtherHiding: Blockchain-Based C2 Technique
EtherHiding is a covert technique that embeds malicious code within smart contracts on public blockchains like BNB Smart Chain or Ethereum. It…
FDMTP Backdoor: Capabilities and Distribution
FDMTP is a backdoor first highlighted by Trend Micro in September 2024, distributed via the PUBLOAD downloader. It establishes C2 communication, gathers…