Sliver

T1583.003 Virtual Private Server C2 and Chisel tunnel aggregation hosted on Contabo VPS (AS51167)

At that point, they captured a victim’s credentials, which led them to query Active Directory.

The remote address field reveals many victims connected through Cloudflare edge IPs ... consistent with web application exploitation for initial access.

Soon enough, an Initial Access Broker (IAB) ... used a phishing campaign and executed offensive hacking tool Sliver on the endpoint.

Also present is a diagnostic script that selects five active beacons and tasks them each a shell command that checks for the following ... Presence of persistence artifacts, such as the cron entry or systemd service

The malicious applet also creates a task in Windows Task Scheduler to gain persistence in the system. The task name has the following format: MicrosoftEdgeUpdateTaskMachineUA{GUID}.

A framework created by cybersecurity researcher Muhammad Osama supports automated penetration testing. Dubbed HexStrike-AI, it connects large language models to more than 150 existing security tools, running them in sequence with retry logic and error recovery.

run-script.ps1, a PowerShell script to load and execute code via PowerShell. The file contains: powershell -w hidden -ep bypass -c "I''E''X...DOWNLOADDaTa(...)"

T1059.004 Unix Shell Shell payloads issued through Sliver Execute RPC

Also present is a diagnostic script that selects five active beacons and tasks them each a shell command that checks for the following ... Presence of persistence artifacts, such as the cron entry or systemd service

The malicious applet also creates a task in Windows Task Scheduler to gain persistence in the system. The task name has the following format: MicrosoftEdgeUpdateTaskMachineUA{GUID}.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

Also present is a diagnostic script that selects five active beacons and tasks them each a shell command that checks for the following ... Presence of persistence artifacts, such as the cron entry or systemd service

Also present is a diagnostic script that selects five active beacons and tasks them each a shell command that checks for the following ... Presence of persistence artifacts, such as the cron entry or systemd service

The malicious applet also creates a task in Windows Task Scheduler to gain persistence in the system. The task name has the following format: MicrosoftEdgeUpdateTaskMachineUA{GUID}.

BUMBLEBEE has Rabbort.DLL embedded, using it for process injection... shi Injects task’s data into a new process... dij Injects task’s data into a new process.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

Also present is a diagnostic script that selects five active beacons and tasks them each a shell command that checks for the following ... Presence of persistence artifacts, such as the cron entry or systemd service

Normally this is the point when we start changing strings and hoping for the best... Maybe the entropy in your binary is off because you wanted to use compression... Maybe the file needs some kind of spoofed Authenticode signature... we need to spend time hardening our binaries against static analysis.

This post is about that loader, which we call WasmForge ... You point it at a Go project and you get back a Windows or macOS binary that runs your tool but doesn’t look anything like it ... The third generates an outer Go binary containing a Wazero runtime, embeds the encrypted WASM module into the binary’s PE sections.

The loader compiles the original tool to WebAssembly, wraps it in a runtime that proxies syscalls and Win32 APIs back to the host, and ships the WASM payload encrypted inside an outer Go binary disguised as a real piece of infrastructure software.

Once we had a working ghost-profile pipeline producing reliably clean binaries... The loader compiles the original tool to WebAssembly, wraps it in a runtime... and ships the WASM payload encrypted inside an outer Go binary disguised as a real piece of infrastructure software.

BUMBLEBEE has Rabbort.DLL embedded, using it for process injection... shi Injects task’s data into a new process... dij Injects task’s data into a new process.

At that point, they captured a victim’s credentials, which led them to query Active Directory.

the C# dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.

Sliver – We tested ... execute-assembly against Seatbelt and Rubeus ... Watching execute-assembly Rubeus.exe kerberoast complete successfully against a domain controller, through a WASM-bridged COM call into the CLR running a loaded Rubeus assembly, was significantly more rewarding ...

On the victim side, the binary is dropped as a hidden dot-prefixed file and persisted at '/var/tmp/.xs.'

Maybe the file needs some kind of spoofed Authenticode signature... Last month one of our build pipelines to obfuscate Sliver started getting hit at 100% by AhnLab... every single binary that we’d faked a digital signature for was detected with that exact rule.

Sliver – We tested beacon and session implants ... file I/O, process listing ... Tribunus ... standard commands like shell, ps, netstat, whoami .

Each beacon receives a SOCKS5 proxy port derived deterministically from an MD5 hash of its Sliver UUID, mapped into the range 10000-14999.

URI patterns and PCAPs analysis yielded evidence of both English word type encoding within Sliver and Gzip formatting.

Some Backdoor.Oldrea samples use standard Base64 + bzip2... gh0st RAT has used Zlib to compress C2 communications data before encrypting it... HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

The threat intelligence company said it found source code, compiled binaries, deployment state logs, internet scanners, exploitation tooling, and a live Sliver configuration after the threat actor behind the operation left two open directories on a command-and-control (C2) server ('213.136.80[.]73') without any authentication.

Palo Alto firewalls likely exploited via the newly disclosed CVEs would commonly utilize the Sliver C2 platform for external communication... multiple devices contacted the Sliver-linked IP address 77.221.158[.]154 using HTTP to retrieve Gzip files.

По MITRE ATT&CK это конкретные техники: Proxy ( T1090, Command and Control ) - маршрутизация C2-трафика через промежуточный узел

Each beacon receives a SOCKS5 proxy port derived deterministically from an MD5 hash of its Sliver UUID, mapped into the range 10000-14999.

Staged in one of the open directories Sliver-integrated SMTP proxy deployment toolkit, along with Chisel tunneling and proxy binaries for most Linux CPU architectures, such as AMD64, ARM64, and x86. On the victim side, the binary is dropped as a hidden dot-prefixed file and persisted at '/var/tmp/.xs.'

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

The applet loading results in the deployment of a Sliver post-exploitation framework implant within the Fondue.exe memory.

External connectivity during this phase also featured TCP connection attempts over uncommon ports for common application protocols... devices utilized destination ports such as 8089, 3939, 8880, 8084, and 9999 for the HTTP protocol.

Several targeted customer devices were observed initiating TLS/SSL connections to rare external IPs with self-signed TLS certificates following exploitation... These TLS/SSL sessions were typically established without the specification of a Server Name Indication (SNI).

Sophos X-Ops analysts observed a threat actor using artificial intelligence (AI) technologies to test endpoint detection and response (EDR) evasion tactics in a “red team” post-exploitation framework.

The activity was detected when an anomalous endpoint registered within a customer tenant triggered alerts... indicative of a broader attack framework focused on evading detection... a lab that uses an iterative approach to developing and testing malware against the Sophos, CrowdStrike, and Windows Defender endpoint detection and response (EDR) agents.