Miasma Malware: Multi-Stage Botnet Loader with Advanced C2 Capabilities
Miasma is a multi-stage botnet loader identified in compromised AsyncAPI npm packages. It features a tasking framework with 744 modules, supporting six…
Tag: C2
Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant
Microsoft has issued a warning about an active phishing campaign targeting hotels and hospitality organizations across Europe and Asia since April 2026.…
TonRAT: Node.js Implant Used in Hotel Phishing Campaign
TonRAT is a Node.js-based implant used in a phishing campaign targeting hotels. It resolves C2 domains via the TON blockchain API and…
MeshCentral: Remote Management Tool Used by Attackers
Attackers deployed custom MeshCentral agents disguised as Microsoft Azure binaries for command-and-control.
Tor Anonymity Network
Tor is an anonymity network. The Atomic Arch stealer uses a Tor onion service for command and control.
Microsoft Graph API: Used for C2 Tasking
TWINLOOT authenticates to an attacker's Azure tenant and uses the Graph API to interact with SharePoint drives for command and control.
pCloud – Cloud Storage Service Provider
pCloud is a cloud storage service that offers API access. The NarwhalRAT malware uses pCloud's API as a secondary C2 channel via…
Cryptocurrency-Stealing Remote Access Trojan Deployed in Mastra Attack
A cross-platform information stealer deployed as the final payload in the Mastra supply chain attack. It harvests browser history, steals data from…
Junior Hacker Used Tailscale and OpenSSH to Maintain Persistent Access After C2 Outage
A French-speaking attacker, operating under the handle 'Poisson,' breached a small French automotive business using a keylogger to steal banking and email…
Havoc: Post-Exploitation Framework
Havoc is a post-exploitation framework used by attackers, including the 'Poisson' operator, to deploy the Demon agent for command and control.