Decoy Manuals and Malicious Browser Extensions: A Closer Look at a Multi-Layered Threat

Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.

A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.

Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.

Hunt uncovered SpyNote Android spyware samples in open directories, disguised as Google Translate, Temp Mail and Deutsche Postbank apps, detailing how the leaked spyware steals user data.

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.

An unsecured directory exposed a red team's toolkit — Cobalt Strike, Havoc and Villain C2 frameworks, BloodHound data and kerberoasted hashes — after poor OPSEC, as first spotted by Justin Elze.