SecuriTricks - sliver

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

A sophisticated breach was identified where threat actors exploited vulnerabilities in SimpleHelp's Remote Monitoring and Management client to infiltrate a network. The attack involved post-compromise tactics including network discovery, administrator account creation, and persistence establishment…

backdoor

exploit

Published: February 7, 2025

Downloadable IOCs: 6

Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

A critical code execution vulnerability, CVE-2024-50603, affecting Aviatrix Controller has been observed being exploited in the wild. This unauthenticated remote code execution flaw allows attackers to execute arbitrary commands on the system, potentially leading to privilege escalation in AWS envi…

Published: January 13, 2025

Downloadable IOCs: 6

Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns

Sophos unveils a five-year investigation tracking China-based threat actors targeting perimeter devices, particularly Sophos firewalls. The report details multiple attack campaigns, including Asnarök, Bookmark Buffer Overflow, and Covert Channels, which exploited zero-day vulnerabilities to gain ac…

sliver

gh0st rat

backdoors

critical infrastructure

china-based threat actors

CVE-2022-3236

asnarök

zero-day vulnerabilities

asia-pacific targets

CVE-2022-1292

Published: October 31, 2024

Downloadable IOCs: 0

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

A long-running campaign was identified involving malicious actors impersonating Israeli entities and private companies. The operators delivered payloads through crafted WordPress sites, employing a mix of custom code and open-source malware like Donut and Sliver. While the motivations remain unclea…

Published: June 28, 2024

Downloadable IOCs: 18

Ongoing Malvertising Campaign leads to Ransomware

Rapid7 detected an ongoing malware distribution campaign involving trojanized installers of WinSCP and PuTTY, delivered via malicious search engine ads. The infection chain employs DLL side-loading, credential access, and deploys Sliver beacons followed by Cobalt Strike. In one case, the threat act…

Published: May 15, 2024

Downloadable IOCs: 78

Tag: sliver

Attack reports

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns

Play Ransomware Engagement

Docker Gatling Gun Campaign

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

Threat Actors’ Toolkit: Leveraging Sliver, PoshC2 & Batch Scripts

Array of malware used to gather intelligence for North Korea

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

Ongoing Malvertising Campaign leads to Ransomware