FREEFIRE

FREEFIRE is a lightweight .NET backdoor identified by Mandiant that uses Slack as its command-and-control channel. It communicates with a hard-coded Slack channel to retrieve commands and upload responses, and it supports loading arbitrary .NET assemblies that are Base64-encoded and delivered via Slack chat comments. Mandiant observed FREEFIRE in post-compromise activity following exploitation of Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966, where attackers hijacked authenticated sessions by stealing NetScaler AAA session cookies from appliance memory. In those intrusions, FREEFIRE was deployed alongside other post-exploitation activity including Active Directory reconnaissance with net.exe, internal network scanning with SoftPerfect netscan.exe, credential theft including LSASS dumping and suspected Mimikatz usage, lateral movement via RDP, and use of RMM tools such as Atera, AnyDesk, and SplashTop. Mandiant tracked multiple UNC clusters exploiting the vulnerability across legal and professional services, technology, and government organizations in the Americas, EMEA, and APJ, but the provided content does not attribute FREEFIRE to a specific named threat actor. No specific FREEFIRE file hashes, domains, or other malware-specific indicators of compromise are provided in the content.