Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

In Plain Sight: Uncovering SuperShell & Cobalt Strike from an Open Directory

hunt.io | blog | #linux | #c2 | #cobalt-strike | #open-directories | #supershell | #goreverse

Summary

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.
Published
Collected

original ↗

Related coverage

blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
blog · hunt.io
Decoy Manuals and Malicious Browser Extensions: A Closer Look at a Multi-Layered Threat
Hunt.io exposes a multi-stage campaign: a scheduled-task executable and 'Dark Mode' Chrome extensions built from open-source spying code, plus a decoy Cobalt Strike PDF pushing duplicates.
blog · hunt.io
Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems
Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.
blog · hunt.io
Legacy Threat: PlugX Builder/Controller Discovered in Open Directory
Hunt discovered an exposed Czech server hosting an outdated PlugX builder and controller, with victim logs and a VBA script abusing a Nepalese government domain; Nepal's CERT was notified.
blog · hunt.io
A Hunt How-To: Detecting RedGuard C2 Redirector
A Hunt how-to on detecting RedGuard, the open-source C2 redirector built with Cobalt Strike in mind, explaining how redirectors obscure real C2 servers and how defenders can find their infrastructure.
back