OnyxC2
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
The package also ships with ready-made lure installers: FinePrint, SystemSettings, a fake Windows update package, and Fling-Standalone for gaming audiences... The combination of a 210-application target list, verified evasion against current antivirus engines, and persistent access turns a single phishing click into standing visibility into someone’s entire working life.
Execution
1 technique
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
4 techniques
Stealth
The payload stays encrypted until runtime, so there’s nothing to detect on disk before execution begins.
Inside the build is a legitimate application carrying a valid Authenticode signature... Paired with it is a DLL disguised as an NVIDIA graphics library... The package also ships with ready-made lure installers: FinePrint, SystemSettings, a fake Windows update package, and Fling-Standalone for gaming audiences.
Credential Access
4 techniques
Credential Access
It includes HVNC over a web browser, LSASS memory dumping, RunPE execution both in memory and on disk...
It includes HVNC over a web browser... screenshot capture, a keylogger, a file manager...
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware-as-a-Service infostealer sold by subscription that steals credentials, cookies, autofill data, payment cards, cryptocurrency wallets, and data from browsers, extensions, password managers, FTP, email, VPN, messaging, and other applications. It also includes remote access capabilities such as HVNC, LSASS dumping, RunPE execution, reverse SOCKS5 proxy, screenshot capture, keylogging, file management, reverse shell over HTTP, Tor tunneling, persistence, and AES-256-encrypted payload delivery using DLL sideloading.
Malware-as-a-Service infostealer sold by subscription that targets browsers, extensions, password managers, cryptocurrency wallets, FTP and email clients, VPN and messaging apps, and includes remote access capabilities such as HVNC, keylogging, screenshot capture, reverse shell, SOCKS5 proxy, LSASS dumping, and persistence. It uses DLL sideloading with encrypted payloads and lure installers to evade detection and maintain access.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.