Loading story…
Splunk released an Enterprise Security analytic to detect socat processes that pair exec: with -listen: arguments, a pattern that can bind an executable to inbound TCP or OpenSSL connections. The resulting listener can provide a bind shell, remote command execution, lateral movement, or command-and-control (C2) tunneling. The detection generates notable findings and risk events from endpoint process telemetry; defenders should tune it for legitimate development, debugging, protocol testing, and network-troubleshooting activity.
Protocol tunneling remains a widely used ATT&CK technique (T1572) for concealing C2 within common services and protocols, including SSH, DNS/DoH, HTTP CONNECT, SOCKS, TLS, and reverse-tunnel platforms such as ngrok. Recent investigations illustrate the risk: REF0657 used iox, Rakshasa, and ICMP tunneling during a financial-services intrusion, while SOMNIRECORD disguised C2 and exfiltration as DNS TXT queries. Elastic also observed suspicious macOS activity in which a coding agent preceded Cloudflare Quick Tunnel use, an ngrok alert, and LaunchAgent persistence, underscoring the need to investigate tunnel creation and persistence even when trusted developer tools initiate them.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Splunk updated its "Socat Network Listener Binding an Executable" Enterprise Security analytic, which detects socat command lines containing both exec: and -listen: arguments. The analytic is intended to identify potential bind shells, remote command execution, lateral movement, or protocol tunneling.
The observed session started cloudflared to expose a local service through Cloudflare Quick Tunnels and raised alerts for lhr[.]life and api.trycloudflare[.]com connections. It also wrote and loaded a LaunchAgent watchdog configured to perform 60-second liveness checks against a trycloudflare login endpoint; Elastic also detected an ngrok binary under zsh and later launchd.
Shells parented by Claude Code made credentialed HTTP(S) requests to lhr[.]life localhost.run tunnel subdomains and Cloudflare Quick Tunnel URLs. The sessions repeatedly polled a tunnel-published login endpoint, submitted credentials, and retrieved API summary metrics.
The macOS host showed increased GenAI or MCP Server Child Process Execution activity during the suspicious multi-day activity chain.
Elastic observed zsh launching a Python script from /tmp that made outbound HTTPS requests to an analytics domain and appeared to retrieve data through plaintext MCP-style JSON-RPC requests. A generic cat utility also wrote to a Claude project MEMORY.md file.
Elastic telemetry recorded malicious_file events involving pritunl-client and wireguard-go on a macOS developer endpoint where Claude Code was installed and actively used.
Elastic observed initial enumeration activity in a REF0657 intrusion affecting a financial-services organization in South Asia. The actors likely used a remotely accessible Microsoft SQL Server and abused xp_cmdshell to execute commands.
Within roughly 24 hours of initial access, REF0657 compressed .bak data and exfiltrated it through the Mega file-hosting service using MEGA CMD renamed as ms_edge.exe. The actors also cleared Windows System and Security event logs.
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the GOGETTER tunneler to establish a Yamux TLS-based command-and-control channel with external servers.
Elastic Security Labs identified the SOMNIRECORD C++ backdoor associated with the REF2924 activity group. The malware retrieves commands through DNS TXT records and exfiltrates hex-encoded command output through DNS queries to masquerade command-and-control traffic as DNS.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceelastic.co
Open sourceelastic.co
Open sourceelastic.co
Open sourceattack.mitre.org
Open sourcegtfobins.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk published a new analytic to detect Linux reverse shells that abuse shell pseudo-devices such as `/dev/tcp` and `/dev/udp` to open outbound connections from `bash`, `sh`, `dash`, or `zsh` without requiring tools like `netcat`. The detection, **Linux Shell Pseudo Device Reverse Shell**, is designed for Splunk Enterprise Security and uses EDR or Sysmon for Linux process telemetry mapped into the CIM Endpoint Processes data model to identify shell redirection patterns commonly used after compromise for remote access and command execution. The analytic is mapped to MITRE ATT&CK techniques **`T1048.003`** and **`T1059`**, linking the behavior to exfiltration over unencrypted non-C2 protocols and command-shell abuse. MITRE documents broad adversary use of alternative outbound protocols—including HTTP, FTP, SMTP, DNS, WebDAV, TCP, and TFTP—for data theft and covert transfer, as well as the use of legitimate utilities such as `curl`, `ftp`, WinSCP, and Rclone. Splunk said the detection generates intermediate risk events by default and warned that legitimate administrative diagnostics or testing can also trigger it, making environment-specific filtering important.
Aug 12, 2026
Sophos detailed incident-response cases in which threat actors abused the legitimate tunneling service **ngrok** to establish command-and-control channels, deliver follow-on payloads, and expose internal systems to the internet. In the observed intrusions, attackers used **PowerShell** or `wget` to download ngrok, launched tunnels to **TCP 3389** for remote desktop access, queried the local ngrok API, and fetched additional malware from ngrok-hosted URLs, taking advantage of the tool's trusted reputation and use of common network ports. The guidance says defenders should verify whether ngrok is approved for business use before taking action, because the software is also widely used legitimately. Sophos recommended hunting across **DNS, process, file, PowerShell, network, scheduled task, prefetch, registry, and Windows event log** telemetry for evidence of abuse, and advised containment through domain and hash blocking, application-control policies, **AppLocker**, and proxy or firewall rules to prevent unauthorized ngrok activity.
Jun 29, 2026
Researchers disclosed **SockDetour**, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates **filelessly** and **socketlessly**, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least **July 2019**. Unit 42 linked the activity to the China-linked **TiltedTemple** cluster, also tracked by Microsoft as **DEV-0322**, and said the campaign overlapped with late-2021 intrusions involving **Zoho ManageEngine** exploitation; reporting also noted possible ties to **APT27** based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised **QNAP NAS** device that had likely been exploited through **`CVE-2021-28799`**, the same flaw previously abused to deploy **eCh0raix** and associated with earlier **QLocker** ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Aug 15, 2026