Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Gh0st and Pantegana: Two RATs that Refuse to Fade Away

hunt.io | blog | #c2 | #rat | #tls-certificates | #malware-infrastructure | #gh0st | #pantegana

Summary

Hunt examines current infrastructure for two RATs: the long-lived Gh0st, detected via its 'Gh0st' packet flag, and the newer Go-based Pantegana, which uses customized certificates to evade scanners.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Tracking ShadowPad Infrastructure Via Non-Standard Certificates
Hunt found 30+ ShadowPad servers using a certificate spoofing Dell's 'Data Vault', with two suspected clusters showing why non-standard certificates uncover fresh infrastructure.
blog · hunt.io
How We Identify Malicious Infrastructure At Hunt.io
Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.
blog · hunt.io
Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems
Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.
blog · hunt.io
Spotting SparkRAT: Detection Tactics & Sandbox Findings
Hunt profiles SparkRAT, the Go-based RAT behind attacks tracked by Microsoft and AhnLab, with detection tips for its default port 8000 and login-page fingerprints.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
back