Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload obtained from the C2 is a tunneling utility named client.py.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.
PowerShell командата е дизајнирана да преземе ZIP архива ... Нападот исто така инсталира перзистентна PowerShell јамка ... ги извршува преку Invoke-Expression.
The runtime is then used to execute client.py, a custom tunneling implant that establishes an encrypted WebSocket connection to attacker-controlled servers.
Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.
Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components.
Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.
Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components.
Auto-run entries masquerad[e] as legitimate Microsoft or software-update components.
The final payload brings its own Python runtime and starts a windowless interpreter, keeping the process out of sight.
The reconnaissance phase involves ... Active Directory ... computer searches [and] Ping named servers to map the internal network topology.
The reconnaissance phase involves ... domain admin enumeration.
The reconnaissance phase involves the following steps - Collect system metadata.
The reconnaissance phase involves ... Active Directory user ... searches.
The reconnaissance phase involves ... Perform domain trust discovery.
gitnow[.]dev [is the] C2 server for custom reverse tunnel implant (port 443).
The loader then communicates with the C2 servers using HTTP POST requests that appear to contain JPEG image files.
[The campaign] deploys a Python runtime and a custom tunneling implant that gives the attacker full TCP proxy access through the victim network.
The resulting tunnel enables the threat actors to relay traffic through the compromised host and access network resources.
Python-базиран reverse-tunnel C2 имплант ... пренасочува произволен TCP сообраќај назад кон инфраструктура контролирана од напаѓачот („gitnow[.]dev:443“).
The hunting table identifies "powershell.exe creating libgcc_s_seh-1.dll and libwinpthread-1.dll beside an unsigned DLL" under a public user directory.
client.py personnalisé établissant un tunnel WebSocket chiffré TLS vers gitnow[.]dev:443, permettant un accès proxy TCP arbitraire de type SOCKS5 au réseau interne.
client.py... establishes an encrypted WebSocket connection to attacker-controlled servers.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.