Tag: c2 communication

7 Attack Reports | 0 Vulnerabilities

Attack reports

GorillaBot: Technical Analysis and Code Similarities with Mirai

GorillaBot is a newly discovered Mirai-based botnet that has launched over 300,000 attacks across more than 100 countries, targeting various industries including telecommunications, finance, and education. It reuses Mirai's core logic while adding custom encryption and evasion techniques. The malwa…

c2 communication

Published: March 25, 2025

Downloadable IOCs: 3

SVC New Stealer on the Horizon

SvcStealer 2025 is a newly discovered information stealer malware distributed through spear phishing emails. It targets sensitive data including machine information, installed software, user credentials, cryptocurrency wallets, and browser data. The malware creates a unique folder, terminates speci…

data exfiltration

information stealer

c2 communication

evasion techniques

Published: March 21, 2025

Downloadable IOCs: 0

Njrat Campaign Using Microsoft Dev Tunnels

A new Njrat malware campaign has been detected utilizing Microsoft's dev tunnels service for command and control (C2) communication. This service, designed for developers to securely expose local services to the internet, is being exploited by the malware to establish connections with C2 servers. T…

malware campaign

c2 communication

usb propagation

microsoft dev tunnels

Published: February 27, 2025

Downloadable IOCs: 6

Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques

ValleyRAT, a sophisticated multi-stage malware attributed to Silver Fox APT, has updated its tactics, techniques, and procedures. The malware targets key roles in finance, accounting, and sales departments using phishing emails, malicious websites, and instant messaging platforms. The infection cha…

dll side-loading

c2 communication

Published: February 5, 2025

Downloadable IOCs: 12

Analysis of the attack activities of APT-C-26 (Lazarus) using weaponized IPMsg software

The Lazarus group, a highly active APT organization, has been observed weaponizing the IPMsg installer for attacks. When executed, the malicious installer releases the official IPMsg version 5.6.18.0 to deceive users while activating a malicious DLL in memory. This DLL connects to a remote control …

social engineering

c2 communication

att_loader_dll.dll

weaponized installer

Published: January 2, 2025

Downloadable IOCs: 3

DarkVision RAT

DarkVision RAT is a customizable remote access trojan that first appeared in 2020, offered on Hack Forums for $60. Written in C/C++ and assembly, it offers features like keylogging, screenshots, file manipulation, process injection, remote code execution, and password theft. The analysis reveals a …

c2 communication

multi-stage attack

remote access trojan

Published: October 10, 2024

Downloadable IOCs: 0

Zharkbot Strings

Zharkbot is a C++ downloader with extensive anti-analysis and anti-sandbox features. It uses in-line string encryption and API calls, making static and emulation analysis challenging. The malware performs sandbox detection by checking for specific usernames and hypervisors. It installs itself in th…

string encryption

c2 communication

Published: September 3, 2024

Downloadable IOCs: 2

Click here to see more Attack Reports