Navigating Through The Fog

An open directory linked to a Fog ransomware affiliate was discovered, containing tools for reconnaissance, exploitation, lateral movement, and persistence. Initial access was gained through compromised SonicWall VPN credentials, while other tools facilitated credential theft and exploitation of Active Directory vulnerabilities. Persistence was maintained via AnyDesk, automated by a PowerShell script. Sliver C2 executables were used for command-and-control operations. The victims spanned multiple industries across Europe, North America, and South America, highlighting the affiliate's broad targeting scope. The toolkit included SonicWall Scanner, DonPAPI, Certipy, Zer0dump, and Pachine/noPac for various attack stages.

Pulse ID: 680f0738479d23f04a10d198
Pulse Link: https://otx.alienvault.com/pulse/680f0738479d23f04a10d198
Pulse Author: AlienVault
Created: 2025-04-28 04:42:32

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Hackers exploit #SimpleHelp #RMM flaws to deploy #Sliver #malware

https://www.bleepingcomputer.com/news/security/hackers-exploit-simplehelp-rmm-flaws-to-deploy-sliver-malware/

Sliver C2 Hunt
#Sliver
https://intelinsights.substack.com/p/sliver-c2-hunt

Инструменты атакующих в 2023–2024 годах

На конференции OFFZONE 2024, которая прошла в Москве в культурном центре ЗИЛ 22–23 августа, выступил наш сотрудник Семён Рогачёв, руководитель отдела реагирования на инциденты. Он рассказал, какие инструменты сегодня чаще всего используются в кибератаках на российскую Linux- и Windows-инфраструктуру, и объяснил, как эффективно отлавливать и отражать подобные атаки. Мы написали текст по мотивам этого доклада, обогатив его данными за конец 2024 года. Статья будет полезна для тех, кто занимается пентестами и реагированием на инциденты.

https://habr.com/ru/companies/bastion/articles/862168/

New #blog post!

In our latest blog, we explore methods to detect the #Sliver framework and explore how to hunt down threat actors like #APT29 (Cozy Bear) who have harnessed its power.

https://www.huntandhackett.com/blog/hunting-for-a-sliver

1/

“I Have So Much Dirt On Her”: Billy Baldwin Fumes At Sharon Stone After Actress Names Producer Who Pressured Her To Sleep With ‘Sliver’ Co-Star
#Casting #News #BillyBaldwin #Paramount #SharonStone #Sliver

https://deadline.com/2024/03/sharon-stone-billy-baldwin-sliver-sex-allegation-1235857028/

A guide to detect and defend against the sticky keys vulnerability, writing a sigma rule for it, AND a homelab guide by @eric_capuano to follow along? What a great project idea.
#SOC #Sliver #Sigma https://lifeaftersoc.substack.com/p/life-after-soc

Практическое применение Sliver’ов для создания современного UI

Hola, Amigos! На связи Саша Чаплыгин, Flutter-dev агентства продуктовой разработки Amiga. В телеграм-канале Flutter. Много мы с командой уже касались темы Sliver'ов . И сегодня я предлагаю больше погрузиться в практику. В нашей текущей работе над приложением для сети пекарен, где множество интересных задач и вопросов интерфейса, я активно применяю Sliver'ы и другие виджеты. Давайте рассмотрим, как эти техники могут преобразить создание современного пользовательского интерфейса.

https://habr.com/ru/articles/794510/

https://github.com/icyguider/UAC-BOF-Bonanza

"This repository serves as a collection of public UAC bypass techniques that have been weaponized as BOFs. A single module which integrates all techniques has been provided to use the BOFs via the Havoc C2 Framework. A extension.json file has also been provided for each bypass technique for use in Sliver."

I recently tweeted about how useful strace can be. Here is an example of a quick malware triage.

I took a recent #Sliver sample mentioned here [1] from Baazar [2] and ran it with strace on a Linux host.

We immediately find the dst_ip and the dst_port of the Sliver sample (screenshot below), making strace an incredibly useful tool for a quick malware triage, especially when doing Incident Response, and we want to find out the C2 address of the malware.

Check out the little strace book for more insights into strace [3]

[1] https://twitter.com/SI_FalconTeam/status/1738217925616496923
[2] https://bazaar.abuse.ch/sample/f5ab886589558a8a265c216f6754d1477c19ca46d8ed4d57a1ee975c590e4aab/
[3] https://nanxiao.github.io/strace-little-book/

As we wrap up 2023, let's take a look back at the different topics we covered in our technical #blog this year.

Our #VulnerabilityResearch series expanded with some new writeups and coordinated disclosure advisories. We also provided practical advice and tooling to aid security researchers in effective #CodeReview using #Semgrep. There’s more in store on this topic: stay tuned for the latest updates.

Exploring various aspects of #OffensiveSecurity, we shared tools and methodologies for #RedTeaming, #WebPentesting, and #MobilePentesting. Don’t miss our popular series on customizing the #Sliver adversary emulation framework and extending #BurpSuite.

As we look forward to another year of research and community sharing, we wish you all happy holidays... and happy hacking!

https://security.humanativaspa.it/

[Перевод] Иголка в стоге сена: ищем следы работы C2-фреймворка Sliver

Привет, Хабр, на связи лаборатория кибербезопасности компании AP Security! Не так давно на нашем канале вышла статья по использованию фреймворка постэксплуатации Sliver C2 от Bishop Fox. Сегодня мы представляем вам исследование компании Immersive Labs по детектированию и анализу нагрузок и туннелей взаимодействия Sliver. Этот С2 всё сильнее набирает популярность, а значит специалисты по реагированию на инциденты должны быть всегда готовы столкнуться лицом к лицу с новыми техниками и инструментами. Приятного прочтения!

https://habr.com/ru/articles/781478/

Here are just a few of the tips from Jon Guild about passing the #OSEP exam (offered by @offsectraining):

- Pick your exam time wisely. If you work better in the morning, choose a morning start time. Choose your battleground!

- Practice, Practice, Practice! Look into Cybernetics ProLab from @hackthebox_eu or the Game of Active Directory (GOAD)

- Know your toolset. Understand the different tools available to you and how they work.

See more of his tips – and how he used the #opensource tool #Sliver to pass– in his write-up.

https://bfx.social/3tnN4ez

Fresh on the @hnsec blog: a new series on customizing #Sliver #C2 by @BishopFox, written by my colleague Alessandro Iandoli

https://security.humanativaspa.it/tag/sliver/

Enjoy!