Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight

hunt.io | blog | #credential-theft | #phishing | #cobalt-strike | #open-directories | #browserghost | #goblin

Summary

A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
Published
Collected

original ↗

Related coverage

blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Decoy Manuals and Malicious Browser Extensions: A Closer Look at a Multi-Layered Threat
Hunt.io exposes a multi-stage campaign: a scheduled-task executable and 'Dark Mode' Chrome extensions built from open-source spying code, plus a decoy Cobalt Strike PDF pushing duplicates.
blog · hunt.io
Pentester or Threat Actor? Open Directory Exposes Test Results and Possible Targeting of Government Officials
Hunt.io examines a 15,923-file server where pentest tools sit alongside credential caches and phishing target lists for government officials in Egypt, Moldova, Nepal, Nigeria, Canada and Ukraine.
blog · hunt.io
Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems
Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.
blog · hunt.io
In Plain Sight: Uncovering SuperShell & Cobalt Strike from an Open Directory
While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.
blog · hunt.io
A Treasure Trove of Trouble: Open Directory Exposes Red Team Tools
An unsecured directory exposed a red team's toolkit — Cobalt Strike, Havoc and Villain C2 frameworks, BloodHound data and kerberoasted hashes — after poor OPSEC, as first spotted by Justin Elze.
back