Sophisticated Tuoni C2 Attack on U.S. Real Estate Firm Thwarted

Description

In October 2025, a major U.S. real estate company was targeted by a highly advanced cyberattack using the emerging Tuoni C2 framework. The attack, which showed signs of AI assistance in code generation, was neutralized by Morphisec's Automated Moving Target Defense (AMTD) technology. The campaign likely began with social engineering via Microsoft Teams impersonation, followed by a malicious PowerShell script. The attack chain involved steganography to hide payloads in images and in-memory execution techniques to evade detection. The Tuoni C2 framework, a sophisticated command-and-control tool, was used as the core implant. Morphisec's prevention-first approach successfully blocked the attack before execution, highlighting the effectiveness of AMTD against unknown threats without relying on signatures or behavioral heuristics.