Malware

DarkMatter

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

In this example, the payload simply executes the whoami command and returns the result through the HTTP response.

T1129Shared ModulesEvidence1

NebulaPulsar decrypts the payload, loads it directly into memory, and transfers execution to it.

Persistence

1 technique

T1505.003Web ShellEvidence3

The environment string serves two purposes: It determines whether the plugin is compatible with the current webshell... For instance, if the environment of the current webshell is PHP/v8.X/OneShell...

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The following features have been added: ... .NET ... Shellcode injection

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

During the initial request, it decrypts the NebulaPulsar implant using XOR... Subsequent payloads (DarkMatter) are then decrypted using AES and executed through the implant.

T1055Process InjectionEvidence1

The following features have been added: ... .NET ... Shellcode injection

T1564.001Hidden Files and DirectoriesEvidence1

This type of webshell is widely used... by dynamically loading Java bytecode directly into memory instead of storing it on disk.

T1620Reflective Code LoadingEvidence4

Languages such as PHP and Classic ASP execute payloads through eval() , while Java and .NET rely on reflective loading.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Once the implant has been injected successfully, subsequent payloads (such as DarkMatter) are encrypted with AES before being sent.

T1573Encrypted ChannelEvidence1

My primary goal was to establish an encrypted communication channel between the client and the implant. To achieve this, I chose AES to encrypt all subsequent communications.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

iss4cf0ng githubNews

Jul 27, 2026

[Alien] How to Develop A Plugin | ISSAC/iss4cf0ng's blog

DarkMatter is referenced as part of the supported Alien shell environment string and payload pathing for plugin execution.

iss4cf0ng githubNews

Jul 21, 2026

[Learning] Inside Different Generations of WebShells (Part 3: Java and C#) | ISSAC/iss4cf0ng's blog

Named follow-on payloads delivered through the NebulaPulsar implant and decrypted with AES for execution.

iss4cf0ng githubNews

Jul 1, 2026

NebulaPulsar 2.0: CFM Webshell and New Features | ISSAC/iss4cf0ng's blog

A related .NET implant/webshell component discussed alongside NebulaPulsar, supporting file upload, reflective loading of executables, and shellcode injection.

iss4cf0ng githubNews

Jun 27, 2026

NebulaPulsar: A Proof-of-Concept In-Memory Implant Framework for JSP and ASP.NET | ISSAC/iss4cf0ng's blog

A command-execution payload used with NebulaPulsar that is loaded in memory and executes operator-supplied system commands, returning encrypted output to the controller.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

DarkMatter

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

In this example, the payload simply executes the whoami command and returns the result through the HTTP response.

T1129Shared ModulesEvidence1

NebulaPulsar decrypts the payload, loads it directly into memory, and transfers execution to it.

Persistence

1 technique

T1505.003Web ShellEvidence3

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The following features have been added: ... .NET ... Shellcode injection

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

During the initial request, it decrypts the NebulaPulsar implant using XOR... Subsequent payloads (DarkMatter) are then decrypted using AES and executed through the implant.

T1055Process InjectionEvidence1

The following features have been added: ... .NET ... Shellcode injection

T1564.001Hidden Files and DirectoriesEvidence1

This type of webshell is widely used... by dynamically loading Java bytecode directly into memory instead of storing it on disk.

T1620Reflective Code LoadingEvidence4

Languages such as PHP and Classic ASP execute payloads through eval() , while Java and .NET rely on reflective loading.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Once the implant has been injected successfully, subsequent payloads (such as DarkMatter) are encrypted with AES before being sent.

T1573Encrypted ChannelEvidence1

My primary goal was to establish an encrypted communication channel between the client and the implant. To achieve this, I chose AES to encrypt all subsequent communications.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

iss4cf0ng githubNews

Jul 27, 2026

[Alien] How to Develop A Plugin | ISSAC/iss4cf0ng's blog

DarkMatter is referenced as part of the supported Alien shell environment string and payload pathing for plugin execution.

iss4cf0ng githubNews

Jul 21, 2026

[Learning] Inside Different Generations of WebShells (Part 3: Java and C#) | ISSAC/iss4cf0ng's blog

Named follow-on payloads delivered through the NebulaPulsar implant and decrypted with AES for execution.

iss4cf0ng githubNews

Jul 1, 2026

NebulaPulsar 2.0: CFM Webshell and New Features | ISSAC/iss4cf0ng's blog

A related .NET implant/webshell component discussed alongside NebulaPulsar, supporting file upload, reflective loading of executables, and shellcode injection.

iss4cf0ng githubNews

Jun 27, 2026

NebulaPulsar: A Proof-of-Concept In-Memory Implant Framework for JSP and ASP.NET | ISSAC/iss4cf0ng's blog

A command-execution payload used with NebulaPulsar that is loaded in memory and executes operator-supplied system commands, returning encrypted output to the controller.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.