Loading story…
Microsoft and allied defenders reported that the open-source Sliver command-and-control framework has become a prominent tool for both nation-state and cybercrime operations, increasingly appearing as an alternative or supplement to Cobalt Strike. Microsoft said Sliver has been observed in intrusions since late 2020, including activity tied to the ransomware affiliate DEV-0237 and campaigns where the Bumblebee loader delivered Sliver payloads, while UK and partner government reporting said Russia’s SVR also adopted Sliver after earlier malware activity was exposed.
The reporting links Sliver use to broader intrusion chains that begin with rapid exploitation of public vulnerabilities and supply-chain compromises, followed by post-compromise actions such as process injection, remote thread creation, lateral movement, and mailbox and cloud-tenant abuse. Defenders were urged to hunt for default Sliver behaviors and HTTP beacon patterns, apply rapid patching, strengthen logging and Microsoft 365 mailbox auditing, and use available detections including YARA, Snort, and Microsoft Defender signatures for Sliver and related malware such as Bumblebee.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published research describing increasing use of Sliver by nation-state actors, ransomware-linked groups, and other threat actors, along with infrastructure analysis and KQL hunting queries for Microsoft 365 Defender.
A 7 May 2021 advisory on SVR tradecraft stated that SVR operators changed tactics after the WellMess advisory and deployed the open-source Sliver framework to help maintain access to existing victims.
Microsoft said it has observed threat actors adopting the Sliver framework in intrusion campaigns since December 2020, including use by nation-state and cybercrime actors.
NCSC, NSA, CISA, and CSE previously issued a joint report in 2020 describing SVR targeting COVID-19 vaccine development organizations using WellMess and WellMail malware.
The open-source Sliver command-and-control framework was first made public in late 2019 and made available on GitHub as an adversary simulation and red-team platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourceaka.ms
Open sourcencsc.gov.uk
Open sourceti.defender.microsoft.com
Open sourceti.defender.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that the open-source **Sliver** command-and-control framework has been repeatedly used in real-world malicious operations, expanding beyond red-team use into opportunistic exploitation and targeted intrusions. Team Cymru documented Sliver activity tied to scanning and likely exploitation of internet-facing systems vulnerable to **Log4j**, **ProxyShell**, and **VMware Horizon**, with some infections appearing to progress to deployment of **Atera** or possible **Virlock** ransomware monetization. The same research also linked Sliver infrastructure and spoofed government-themed domains to activity targeting organizations in Pakistan and Turkey, with telemetry suggesting overlap with **Cobalt Strike** on related infrastructure. Separate analysis from AhnLab described a supply-chain-style campaign in South Korea in which trojanized installers posing as VPN and marketing software delivered malware that injected **Sliver** into `notepad.exe`, then installed **MeshAgent** for persistence and, in some cases, a webcam-capture tool. Research presented by IIJ and JPCERT/CC further showed that Sliver is one of several publicly available post-exploitation frameworks now commonly abused by attackers, and highlighted detectable artifacts including its default process injection into `notepad.exe`, along with execution and persistence traces in Windows event logs. Together, the reports show Sliver has become a mainstream attacker tool for initial access, remote control, persistence, and follow-on payload delivery.
Aug 15, 2026
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026
Mandiant reported that **DARKSIDE** operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion. The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities `Regsvcs` and `Regasm` under MITRE ATT&CK **`T1218.009`** to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through **Cobalt Strike** named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs **17** and **18** to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
Aug 15, 2026