SecuriTricks - c2 communication

Njrat Campaign Using Microsoft Dev Tunnels

A new Njrat malware campaign has been detected utilizing Microsoft's dev tunnels service for command and control (C2) communication. This service, designed for developers to securely expose local services to the internet, is being exploited by the malware to establish connections with C2 servers. T…

njrat

malware campaign

c2 communication

usb propagation

2025-02-27

microsoft dev tunnels

Published: February 27, 2025

Downloadable IOCs: 6

Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques

ValleyRAT, a sophisticated multi-stage malware attributed to Silver Fox APT, has updated its tactics, techniques, and procedures. The malware targets key roles in finance, accounting, and sales departments using phishing emails, malicious websites, and instant messaging platforms. The infection cha…

Published: February 5, 2025

Downloadable IOCs: 12

Analysis of the attack activities of APT-C-26 (Lazarus) using weaponized IPMsg software

The Lazarus group, a highly active APT organization, has been observed weaponizing the IPMsg installer for attacks. When executed, the malicious installer releases the official IPMsg version 5.6.18.0 to deceive users while activating a malicious DLL in memory. This DLL connects to a remote control …

Published: January 2, 2025

Downloadable IOCs: 3

DarkVision RAT

DarkVision RAT is a customizable remote access trojan that first appeared in 2020, offered on Hack Forums for $60. Written in C/C++ and assembly, it offers features like keylogging, screenshots, file manipulation, process injection, remote code execution, and password theft. The analysis reveals a …

Published: October 10, 2024

Downloadable IOCs: 0

Zharkbot Strings

Zharkbot is a C++ downloader with extensive anti-analysis and anti-sandbox features. It uses in-line string encryption and API calls, making static and emulation analysis challenging. The malware performs sandbox detection by checking for specific usernames and hypervisors. It installs itself in th…

Published: September 3, 2024

Downloadable IOCs: 2

Tag: c2 communication

Attack reports

Njrat Campaign Using Microsoft Dev Tunnels

Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques

Analysis of the attack activities of APT-C-26 (Lazarus) using weaponized IPMsg software

DarkVision RAT

Zharkbot Strings