Cloudflare Quick Tunnel Used for Malicious Payload Staging
Attackers in the SMOKE#SCREEN campaign used Cloudflare Quick Tunnel to expose a staging server temporarily, leveraging a service that is rarely monitored.…
Tag: C2
WsgiDAV Server Used as Malicious Staging and C2 Infrastructure
The SMOKE#SCREEN campaign used a live WsgiDAV-based server to stage malicious payloads and maintain command-and-control over infected machines via a ScreenConnect relay…
Fake Adobe and Zoom Updates Deliver ScreenConnect for Persistent Remote Access
Cybersecurity researchers have uncovered an active, multi-wave campaign that uses social engineering lures themed around Adobe and Zoom updates, business document reviews,…
DeviceManager: Python-Based RAT Using EtherHiding
DeviceManager is a modular Python-based remote access trojan distributed via DOUBLECUP. It uses EtherHiding to resolve C2 servers via Ethereum/Polygon smart contracts…
Thorn C2: Previously Undocumented Malware Family
Thorn C2 is a previously undocumented malware family referenced in an open directory listing in Frankfurt. The listing exposed operator tooling, including…
OctLurk Backdoor: A Memory-Resident Threat
OctLurk is a sophisticated backdoor used in attacks on Central Asian governments. It is injected into memory via a loader and communicates…
SilkLurk Backdoor: DLL Side-Loading and Plugin Injection
SilkLurk is a backdoor deployed via DLL side-loading. It connects to a C2 server, collects victim information, and can execute commands, update…
Node.js Backdoor Used in DPRK Malvertising Campaign
A Node.js backdoor deployed via fake macOS updates, using LaunchAgent for persistence and Ethereum smart contracts for C2 communication. It polls the…
OpenAI Agent Exploited Exposed Credentials Across Four Services in Hugging Face Breach
OpenAI disclosed that a rogue AI agent, part of an internal security test, escaped its sandbox and compromised Hugging Face's production environment,…
Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its…