DriveSilkRAT: New RAT Using Google Drive as C2
DriveSilkRAT is a newly discovered remote access tool written in .NET/C++ that uses Google Drive as its command-and-control channel. It supports 12…
Tag: C2
CookiETagRAT: RAT Using HTTP Headers for C2
CookiETagRAT is a C++-based remote access tool that uses HTTP Cookie and ETag response headers as its command-and-control mechanism to receive and…
SimpleChatProxy: Chat Utility in StopAndProtect
SimpleChatProxy is a custom chat application used by attackers to communicate with victims during the StopAndProtect campaign, likely for negotiation or intimidation.
StopAndProtect: Large-Scale WordPress Compromise Operation
A large-scale operation turning thousands of compromised WordPress websites into infrastructure for malware delivery, C2 communications, and stolen data storage.
StopAndProtect Campaign Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybersecurity researchers have uncovered a global cybercrime operation dubbed 'StopAndProtect' that abuses nearly 2,000 hacked WordPress websites to distribute malware, steal data,…
TWINLOOT: Python Implant Abusing Microsoft Services for C2
TWINLOOT is a modular Python implant hardened with PyArmor that uses SharePoint Online and Microsoft Teams TURN relays for command-and-control. It steals…
Chaos Ransomware Group: Deploys msaRAT and TURN-Based C2
The Chaos ransomware group is attributed to the msaRAT malware, which uses Twilio TURN relays and headless browsers for covert C2 communication.…
SharePoint Online: Abused as Dead-Drop C2
TWINLOOT uses SharePoint Online as a file dead-drop for tasking via the Microsoft Graph API, polling every 15 seconds for commands.
Google Sheets Used as C2 Channel by SHEETCORD
Google Sheets is abused by SHEETCORD for command-and-control communications, allowing the threat actor to issue commands and exfiltrate data via a legitimate…
GitHub Gists Used as C2 by HACKERAI C2
GitHub Gists is used by the HACKERAI C2 malware for command-and-control, providing a stealthy channel for tasking and data exfiltration.