Loading story…
Palo Alto Networks Unit 42 reported the discovery of Splinter, a previously unidentified post-exploitation red team tool found on multiple customer systems through Advanced WildFire memory scanning. The malware is a Rust-based Windows implant that stores JSON configuration data and communicates with its command-and-control infrastructure over HTTPS, indicating a mature framework designed for stealthy operator control after initial compromise.
Researchers said Splinter supports a broad set of post-exploitation capabilities, including command execution, file transfer, remote process injection, cloud account information gathering, and self-deletion. Unit 42 did not attribute the tool to a known threat actor, but warned that its feature set makes it dangerous if adopted by criminal operators; the report also published technical indicators such as a SHA-256 sample hash, a debug PDB path exposing the internal project name, and C2 URL paths used for tasking, heartbeat, and file operations.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Unit 42 publicly released its first look at Splinter, describing it as a Rust-based Windows implant with HTTPS C2 communications, tasking capabilities, and no confirmed attribution to a known threat actor.
Palo Alto Networks identified a previously unknown post-exploitation red team tool named Splinter on multiple customer systems using Advanced WildFire memory scanning, and confirmed several affected customers through telemetry searches.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that the open-source **Sliver** command-and-control framework has been repeatedly used in real-world malicious operations, expanding beyond red-team use into opportunistic exploitation and targeted intrusions. Team Cymru documented Sliver activity tied to scanning and likely exploitation of internet-facing systems vulnerable to **Log4j**, **ProxyShell**, and **VMware Horizon**, with some infections appearing to progress to deployment of **Atera** or possible **Virlock** ransomware monetization. The same research also linked Sliver infrastructure and spoofed government-themed domains to activity targeting organizations in Pakistan and Turkey, with telemetry suggesting overlap with **Cobalt Strike** on related infrastructure. Separate analysis from AhnLab described a supply-chain-style campaign in South Korea in which trojanized installers posing as VPN and marketing software delivered malware that injected **Sliver** into `notepad.exe`, then installed **MeshAgent** for persistence and, in some cases, a webcam-capture tool. Research presented by IIJ and JPCERT/CC further showed that Sliver is one of several publicly available post-exploitation frameworks now commonly abused by attackers, and highlighted detectable artifacts including its default process injection into `notepad.exe`, along with execution and persistence traces in Windows event logs. Together, the reports show Sliver has become a mainstream attacker tool for initial access, remote control, persistence, and follow-on payload delivery.
Aug 15, 2026
Threat researchers uncovered multiple malware campaigns abusing trusted developer and AI distribution platforms to spread **Rust-based infostealers** through fake or typosquatted repositories. HiddenLayer found that a malicious Hugging Face project, `Open-OSS/privacy-filter`, impersonated OpenAI’s legitimate Privacy Filter repository, briefly became the platform’s top trending project, and was downloaded about **244,000** times before removal. The repository’s `loader.py` fetched a multi-stage payload ending in the `sefirah` infostealer, which harvested browser data, Discord tokens, cryptocurrency wallet data, SSH/FTP/VPN credentials, local files, system details, and screenshots, then exfiltrated the data to `recargapopular[.]com`. Researchers also linked the activity to overlaps with an npm typosquatting campaign associated with the **WinOS 4.0** implant. In a parallel campaign, Netskope reported that attackers impersonated the OpenClaw project with a fake installer site and a typosquatted GitHub organization to deliver a previously undocumented Rust dropper called **Hologram** and a modular implant framework. The malware targeted credentials from more than **250** cryptocurrency wallet, password manager, and 2FA browser extensions, while using anti-sandbox checks, in-memory .NET execution, reflective PE loading, persistence via `Userinit`, COM hijacking, and scheduled tasks, plus direct NT syscall thread injection. Operators staged and relayed infrastructure through legitimate services including **Azure DevOps, Telegram, Hookdeck, snippet.host, and Pastebin**; Netskope said the operation marked the first documented malware abuse of Hookdeck as a C2 relay and later evolved into a third wave, **Pathfinder**, that added confirmed Vidar infostealer delivery.
Jun 29, 2026
Threat actors have begun using the open-source **Havoc** post-exploitation framework in real-world attacks, positioning it as an alternative to tools such as **Cobalt Strike**, **Sliver**, and **Brute Ratel**. Researchers observed a targeted intrusion against an unnamed government organization in which attackers delivered a ZIP archive containing a decoy document and a malicious `.scr` file that installed the **Havoc Demon** implant. Once deployed, the malware enabled remote command execution, collection of command output, encryption of results, and exfiltration to attacker-controlled command-and-control infrastructure. Analysis cited in multiple reports said Havoc includes evasion features such as **indirect syscalls** and **sleep obfuscation**, helping it bypass fully updated **Windows 11 Defender** protections. The framework was also linked to a malicious npm package, `aabquerys`, which triggered a three-stage infection chain to fetch the Demon payload before the package was removed. The activity reflects a broader trend of offensive security frameworks escaping legitimate red-team use and being repurposed by attackers for stealthy post-compromise operations.
Jul 12, 2026