Loading malware…
Sliver is an open-source adversary-simulation and command-and-control framework used for authorized security testing and malicious post-exploitation activity. Its Go-based implants provide backdoor access, interactive shell and command execution, bidirectional file transfer, screenshot capture, and remote host control. Sliver supports code injection into local and remote processes, host reconnaissance, lateral-movement tooling, and data exfiltration over command-and-control channels. Observed communications include HTTP, HTTPS, DNS, and mutually authenticated TLS.
Sliver implants have been deployed on Windows and Linux systems, including compromised enterprise edge appliances. Attackers frequently install Sliver after exploiting internet-facing applications rather than using it as the initial exploitation component. KrustyLoader has delivered Sliver as a second-stage payload in campaigns involving Ivanti Connect Secure, Ivanti Endpoint Manager Mobile, ConnectWise ScreenConnect, Apache ActiveMQ, and JetBrains TeamCity. Sliver has also been deployed following exploitation of Atlassian Confluence. Operators have used its command channel to retrieve additional tools for account enumeration, privilege escalation, and internal network discovery.
Documented users include APT29 and Shedding Zmiy, a cluster associated with Cobalt/ExCobalt. Shedding Zmiy deployed Sliver across Windows and Linux environments in intrusions affecting Russian government, IT, and energy organizations, establishing Linux persistence through systemd and cron. Malicious deployments have also included packed beacon shellcode and obfuscated standalone implants. Sliver is shared tooling used by multiple unrelated operators; its presence alone does not establish attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
21 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Rust payloads detected by Volexity team turn out to be pretty interesting Sliver downloaders as they were executed on Ivanti Connect Secure VPN after the exploitation of CVE-2024-21887 and CVE-2023-46805.
Rust payloads detected by Volexity team turn out to be pretty interesting Sliver downloaders as they were executed on Ivanti Connect Secure VPN after the exploitation of CVE-2024-21887 and CVE-2023-46805.
CVE-2023-46604 allows remote attackers with network access to a broker to execute arbitrary shell commands. This is achieved by exploiting serialized class types within the OpenWire protocol, which, in turn, leads to the broker instantiating any class available on the classpath.
CVE-2025-4428 is what the attacker does next: the invalid format value is copied into an error message that Java evaluates as an expression, so a crafted value runs system commands.
CVE-2025-4427 is a CVSS 5.3 authentication bypass in Ivanti Endpoint Manager Mobile (EPMM) 12.5.0.0 and earlier. Chained with CVE-2025-4428, it gives an unauthenticated attacker code execution on the server.
Fortinet researchers reported APT29 exploitation of TeamCity vulnerability CVE-2023-42793 in September 2023, alongside other actors whose activity resembled the observed KrustyLoader/ScreenConnect campaign.
CVE 2024-0012 is an authentication bypass vulnerability affecting unpatched versions of Palo Alto Networks Next-Generation Firewalls. When combined with CVE-2024-9474, it enables unauthenticated adversaries to execute arbitrary commands on the firewall with root privileges.
Case 2 describes a ransomware incident involving an Exchange server as the initial entry point. Recovered requests showed web-shell deployment and use characteristic of “ProxyShell (CVE-2021-34523),” including commands that downloaded and executed a Sliver implant.
Rapid7 identified evidence of exploitation for CVE-2023-22527 within available Confluence logs. This vulnerability is a critical OGNL injection vulnerability that abuses the text-inline.vm component of Confluence by sending a modified POST request to the server.
CVE-2024-9474 is a privilege escalation vulnerability that allows a PAN-OS administrator with access to the management web interface to execute root-level commands, granting full control over the affected device.
In the second incident, we found traces of successful exploitation of CVE-2025-53770 within 24 hours of a working exploit being published, and failed attempts within a few hours of the first, non-working exploits appearing.
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | ...resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner...
We have previously published a blog on what organizations need to know about the actively exploited CVE-2025-55182, which is a critical (CVSS 10.0) pre-authentication remote code execution vulnerability affecting React Server Components (RSC) used in React.js, Next.js, and related frameworks. | Threat actors also leveraged the React2Shell vulnerability to deploy Sliver Payload to Linux hosts.
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | ...resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner...
Cisco Talos also identified attacks targeting three additional vulnerabilities within Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). All three vulnerabilities were disclosed along with security patches in February 2026. | ...resulting in the deployment of webshell (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner...
In one instance, a victim was observed connecting to TCP/80 on 193.27.228.127, potentially indicative of an exploitation of Log4j, with subsequent connections to 193.27.228.127:8888. This victim was identified running VMware Horizon and was therefore likely vulnerable to CVE-2021-44228 and CVE-2021-45046. | In this post we will discuss the Sliver C2 framework and its usage for potentially malicious purposes since the start of 2022.
Data from GreyNoise further highlighted the use of 193.27.228.127 for malicious purposes, targeting Log4j and Exchange (ProxyShell) vulnerabilities. In one instance, a victim was observed connecting to TCP/80 on 193.27.228.127, potentially indicative of an exploitation of Log4j, with subsequent connections to 193.27.228.127:8888. This victim was identified running VMware Horizon and was therefore likely vulnerable to CVE-2021-44228 and CVE-2021-45046. | In this post we will discuss the Sliver C2 framework and its usage for potentially malicious purposes since the start of 2022.
IP 67.217.57[.]240 December 2025 Sliver C2 infrastructure
Анализ атакованных инфраструктур показал, что в большинстве случаев злоумышленники получали первоначальный доступ путем эксплуатации уязвимости Exchange, а именно — ProxyShell, которая позволяет полностью скомпрометировать сервер. | Все обнаруженные экземпляры Sliver в рамках этого исследования были сконфигурированы для общения с С2 185.221.153[.]121 по протоколу mTLS.
The March 2026 record on port 8080 was more substantial: 79 files across 13 subdirectories totaling 4 MB. Key contents included a pwnkit/ directory with CVE-2021-4034 (834 KB across 7 files), a TLS certificate and private key pair for C2 authentication, and a Python HTTP C2 script. A complete staging directory confirming the operator pursues privilege escalation on compromised hosts.
Check Point researchers said the tool is being discussed on underground forums, where hackers are exchanging instructions on how to deploy it against three Citrix NetScaler flaws disclosed last week: CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424. The most critical of these, CVE-2025-7775, allows unauthenticated remote code execution.
38 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
File name slvbeaconsc.bin SGN/Donut-packed Sliver beacon shellcode
Shedding Zmiy deployed Sliver implants on Windows and Linux, including implants communicating with mtls://195.2.76[.]120:443.
Sliver ... Application Layer Protocol: DNS ... Exfiltration Over C2 Channel ... Process Injection ... Screen Capture.
KrustyLoader, in turn, downloaded the post-exploitation toolkit Sliver.
In all samples we found, the payload was Sliver; however, other payloads cannot be ruled out.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
The server then executes the attacker’s shell command ( id , or wget , or anything ) with full Node.js privileges.
«PowerShell (T1059.001, Execution). Для выполнения команд красные используют PowerShell... типичный паттерн: powershell -ep bypass -nop -w hidden с последующей загрузкой C2-агента».
The recovered build retained the full Sliver capability set, including interactive shell access
This file is a bash script used to enumerate the operating system, download cryptomining installation files, and then execute the cryptomining binary.
KrustyLoader decrypts the payload in memory, injects it into a live explorer.exe process using a dynamically resolved thread-creation function ( RtlCreateUserThread )
The following query finds potential launch of the built-in GetSystem command... The query looks for SeDebug privileges being added to a process, followed by that same process creating a remote thread in spoolsv.exe within 30 seconds. | The query looks for SeDebug privileges being added to a process... where ActionType == 'ProcessPrimaryTokenModified'
sets a systemd service for persistence, claiming to be an “Rsyslog AV Agent Service”.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.
KrustyLoader decrypts the payload in memory, injects it into a live explorer.exe process using a dynamically resolved thread-creation function ( RtlCreateUserThread )
The following query finds potential launch of the built-in GetSystem command... The query looks for SeDebug privileges being added to a process, followed by that same process creating a remote thread in spoolsv.exe within 30 seconds. | The query looks for SeDebug privileges being added to a process... where ActionType == 'ProcessPrimaryTokenModified'
«URI и заголовки имитируют легитимные API-эндпоинты ... Accept, Accept-Language, X-Requested-With — как у реального AJAX-запроса».
Within the Sliver payload, Rapid7 confirmed the following IP address 193.29.13[.]179 would communicate over port 8888 using the mTLS authentication protocol.
Two additional devices were seen with HTTP POST requests to 77.246.103[.]110 and 212.113.106[.]100 with a new PowerShell user agent.
Notable MITRE ATT&CK Tactics and Techniques ... T1071.004 – Application Layer Protocol: DNS.
Published third-party research places malware infrastructure in SYSECT-routed prefixes: Kimwolf v7 C2 endpoints in 212.193.31.0/24; an Aisuru-matched sample contacting 147.45.44.34:8001; and a possible Sliver C2 at 89.19.220.70:4443. Bitsight also documented Aisuru/Kimwolf proxy infrastructure in ML Cloud-geofeed-declared ranges.
The recovered build retained the full Sliver capability set, including interactive shell access, in-memory tool execution without writing files to disk, and a SOCKS5 proxy tunnel for lateral movement through the internal network.
«Каналы управления — тактику Command and Control: External Proxy (T1090.002)»; «CDN или коммерческий reverse proxy ... принимает трафик от имплантов».
«Multi-hop Proxy (T1090.003)»; «между имплантом и тимсервером — минимум два слоя redirector'ов».
Notable MITRE ATT&CK Tactics and Techniques ... T1102.001 – Web Service: Dead Drop Resolver.
«Ingress Tool Transfer (T1105, Command and Control). Загрузка дополнительных инструментов — C2-агентов Mythic или Sliver, скриптов для persistence».
An attacker controlling a compromised implant can crash the entire Sliver teamserver by returning a malformed or empty Download response. Zero-length or 1-3 byte payloads trigger an out-of-bounds slice access ... and terminate the server process, affecting all connected operators.
551 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named offensive framework included in the operation's ATT&CK tool-acquisition mapping. No Sliver-specific execution, implant behavior, or victim deployment is described.
Named offensive framework included in the campaign’s tool-acquisition mapping. No specific deployment or capabilities are described for Sliver in this reference.
A comprehensive offensive tool suite whose use by threat actors reportedly decreased. No specific deployment or campaign is identified.
Mentioned as an example of a command-and-control implant that red teamers may deploy as shellcode. The article discusses maze-based shellcode concealment but does not demonstrate the technique using Sliver.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.