Shellcode injection and AV evasion
injection/memoryinjection/shellcode
Fallout in go, Sep 14 – Sep 20
What we caught this week while monitoring over 159,750,626 artifacts across 46 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Sep 20 · 85 catches · 0 waves · 3 singlesShellcode injection and AMSI bypass
injection/memoryinjection/shellcode
PowerShell Empire C2 framework
Invoke/MetasploitInvoke/Shellcodemsil
SATURDAY
Sat Sep 19 · 79 catches · 2 waves · 3 singlesC2 framework with RAT capabilities
dump/processread/dump
Contains actual malware samples
stealer/surveillancestaging/encrypted
Contains actual malware samples
Windows/Wannacrystaging/encrypted
Embedded PHP webshell payload
exploit/sandbox-escapeeval/remote
C2 framework with RAT capabilities
dump/processread/dump
C2 framework with RAT capabilities
dump/processread/dump
FRIDAY
Fri Sep 18 · 67 catches · 0 waves · 3 singlesPost-exploitation C2 framework
windows/hacktool_sharpwmiKeepassconfig/Gen
Mirai botnet malware source
botnet/mirai-katrina
Mirai botnet malware source
botnet/mirai-katrinabrute-force/iot
CTF webshells and exploits included
PHP/Genericexploit/include-gadget
THURSDAY
Thu Sep 17 · 17 catches · 0 waves · 3 singlesPost-exploitation framework with obfuscation
backdoor/emp3r0rtrojanized/package
Credential theft and persistence
exploit/sql-injectionllm/override
WEDNESDAY
Wed Sep 16 · 3 catches · 0 waves · 3 singlesJava deserialization exploit tool
exploit/deserializationexploit/gadget
PowerShell dropper in main.go
policy/executionOR/Download
Credential theft and persistence
exploit/sql-injectionencoding/shell
MONDAY
Mon Sep 14 · 3 catches · 0 waves · 3 singlesContains PHP webshell and obfuscation
PHP/Genericcode-metrics/identifiers
Impacket offensive security toolkit
OR/DownloadMulti/Ntlmrelayx
Obfuscated payload in eslint config
eval/loadereval/dynamic
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories