Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PowerShell execution is provided by PsProxy.dll, embedded as Base64 within the backdoor and loaded through Assembly.Load().
PowerShell execution is provided by PsProxy.dll, embedded as Base64 within the backdoor and loaded through Assembly.Load().
The loader decrypted the ShelbyC2 V2 backdoor and used PsProxy.dll to run commands through the PowerShell engine without starting PowerShell.exe.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PowerShell execution component embedded in RuntimeBrokerApi.dll. Its PsProxy.PSExecutor.RunCommand method creates a System.Management.Automation runspace and executes commands inside the existing process, avoiding the powershell.exe child process expected by some detection rules. Its development path also links it to the StarkMeet decoy.
Named execution component used in the infection chain to run commands through the PowerShell engine in memory without spawning PowerShell.exe. The indicators table identifies it as an in-memory PowerShell execution engine.
In-memory PowerShell execution module used by ShelbyC2 V2. It loads the PowerShell automation engine and creates a runspace inside the compromised host process, executing commands without launching PowerShell.exe or writing scripts to disk. Its isolated execution compartment helps prevent script failures from disrupting the primary C2 connection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.