BridgeHead: WebSocket SOCKS5 Tunnel Proxy
BridgeHead is a custom WebSocket-based SOCKS5 tunnel proxy used by Nimbus Manticore. It shares functional overlaps with MiniFast and allows the C2…
Tag: WebSocket
ArcBridge: WebSocket Tunneling Tool
ArcBridge is a custom WebSocket tunneling tool used by Nimbus Manticore, observed in April 2026 targeting victims in the Middle East. It…
Mercury Workshop: Developer of Wisp Protocol
Mercury Workshop is the developer of the Wisp protocol, a low-overhead protocol for tunneling many TCP and UDP sockets over a single…
MINIRECON: Toneshell Variant Backdoor
MINIRECON is a reworked variant of the Toneshell backdoor, beaconing over WebSocket on HTTPS, used by Mustang Panda.
Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Google Threat Intelligence Group (GTIG) has attributed a previously undocumented .NET backdoor named STOCKSTAY to the Russian state-sponsored threat actor Turla. The…