Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment

hunt.io | blog | #attack-chains | #malware | #threat-hunting | #c2 | #multi-stage | #persistence | #open-directory | #byob

Summary

A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries
An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.
blog · hunt.io
AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories
ConnectWise ScreenConnect installers were trojanized to deliver AsyncRAT from at least eight hosts, with payloads unseen on VirusTotal, ClickOnce /Bin/ pivots and scheduled-task persistence.
blog · hunt.io
How We Identify Malicious Infrastructure At Hunt.io
Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.
blog · hunt.io
Introducing the Hunt.io C2 Feed
Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.
blog · hunt.io
Transparency of Attacker Tooling
How open directories aid threat hunting and incident response: exposed C2 executables, configs, bash history and RAT logs can reveal victims; Hunt automates finding and pivoting on them.
blog · hunt.io
Let's go Hunting
The launch of Hunt.io: a threat-hunting platform with feeds of active C2 servers across 125+ malware families, open-directory counterintelligence and malicious-infrastructure data.
back