Tracking Pyramid C2: Identifying Post-Exploitation Servers in Hunt

PowerUpSQL's core capabilities land in Empire as six modules, from SPN-based SQL Server discovery to xp_cmdshell OS command execution for lateral movement.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt discovered an exposed Czech server hosting an outdated PlugX builder and controller, with victim logs and a VBA script abusing a Nepalese government domain; Nepal's CERT was notified.

Hunt tracks 400+ exposed Viper login pages for the Chinese red-team platform, over half on Tencent servers at default port 60000, and shares detection guidance for tools like Sliver.

Hunt profiles SparkRAT, the Go-based RAT behind attacks tracked by Microsoft and AhnLab, with detection tips for its default port 8000 and login-page fingerprints.

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.