🚨 The #DFRWSEU 2026 paper submission deadline has been extended to 10th October 2025 🎉 Submit your paper showcasing cutting-edge digital forensics research. 📤 Submit here: buff.ly/BN8Jlnb ℹ️ Conference details: buff.ly/KOw9Xpr #DFRWS #DigitalForensics #CFP

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #PseudoManuscrypt and #ValleyRAT. netresec.com?b=259a5af

Video: Detecting #XenoRAT C2 connections using example traffic from known malware sample. 🔥 e0b465d3bd1ec5e95aee016951d55640 🔥 5ab23ac79ede02166d6f5013d89738f9 📡 Huy1612-24727.portmap[.]io:24727 📡 193.161.193.99:24727 📡 147.185.221.30:54661 netresec.com?b=258f641

How to identify #PureRAT (aka #ResolverRAT): ⛳️ C2 port is often 56001, 56002 or 56003 🔢 Bot sends 04 00 00 00, then TLS handshake 🔑 Client and server run TLS 1.0 🖊️ X.509 cert is self signed 📅 X.509 cert expires 9999-12-31 netresec.com?b=2589522

💧 Dropper connects to legitimate website 📄 Fake PDF is downloaded over HTTPS 💾 Fake PDF is decrypted to a #PureLogs DLL ⚙️ InstallUtil.exe or RegAsm.exe is started 💉 PureLogs DLL is injected into the running process 👾 PureLogs connects to C2 server netresec.com?b=257eead

CapLoader 2.0.1 Released ⚠️ IP lookup alert 🔎 Better protocol identification 🐛 Bug fixes netresec.com?b=2571527

Does anyone know what malware this is? C2 is on 104.16.0.0/13 (CloudFlare). C2 domains: 🔥 event-time-microsoft[.]org 🔥 windows-msgas[.]com 🔥 event-datamicrosoft[.]live 🔥 eventdata-microsoft[.]live PCAP from @malware-traffic-analysis.net infosec.exchange/@netresec/11...

Video: Detecting #PureLogs C2 traffic with #CapLoader netresec.com?b=256a8c4

CapLoader 2.0 released today! 🔎 Identifies over 250 protocols in #PCAP 🎨 Define protocols from example traffic 🇶 Extracts JA3, JA4 and SNI from QUIC 💻 10x faster user interface netresec.com?b=256dbbc

Thank you CISA, @ncsc.gov.uk, @bsi.bund.de et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting! www.cisa.gov/news-events/...

Comparison of tools that extract files from #PCAP 📖 #Chaosreader ⛏️ #NetworkMiner 🐿️ #Suricata 🌊 #tcpflow 🦈 #Wireshark 👁️ #Zeek netresec.com?b=255329f

Did you know that NetworkMiner parses the #njRAT protocol? The following artefacts are extracted from njRAT C2 traffic: 🖥️ Screenshots of victim computer 📁 Transferred files 👾 Commands from C2 server 🤖 Replies from bot 🔑 Stolen credentials/passwords ⌨️ Keylog data netresec.com?b=2541a39

New instructions for installing NetworkMiner on Linux netresec.com?b=2542784

NetworkMiner 3.0 Released! 🔐 QUIC 🏭 CIP (EtherNet/IP) 🏭 UMAS (over Mobdus) 👾 Remcos RAT 🔍 Improved OS fingerprinting 🐧 Better Linux integration netresec.com?b=254caa9

How to set #PCAP as default savefile format in #Wireshark 📝 Edit 📃 Preferences 💡 Advanced ✍️ Change capture.pcap_ng to FALSE netresec.com?b=2523d40

Here's a feature request to have #Wireshark bring back PCAP as the default savefile format instead of pcapng. gitlab.com/wireshark/wi...

PolarProxy 1.0.1 Released 🆔 More #JA4 🔂 Fail-open on #TLS errors ⏩ Better performance netresec.com?b=2523c96

This is an interesting Kerberos relay attack! It leverages LLMNR spoofing/poisoning to trick victims to connect to the attacker's machine and authenticate using Kerberos.

A TLS firewall is similar to a DNS firewall, except it blocks connections to unwanted websites even if the DNS traffic is encrypted. netresec.com?b=2515cf0

We’ve now scheduled our next Network Forensics for Incident Response training 📅 Dates: May 12-15, 2025 🕑 Duration: Four half-days 🌐 Type: Live Online Network Forensics Training 💵 Price: € 960 EUR www.netresec.com?page=Training

APT29 / Midnight Blizzard / Earth Koshchei use RDP relays to gain control of victims’ machines. One RDP config pretends to be for Regeringskansliet (Swedish Gov). Thanks to @feikeh.bsky.social and @sjhilt.hilt.zip‬ for sharing indicators! www.trendmicro.com/en_us/resear... tria.ge/241023-qpfnl...

@piotrkijewski.bsky.social on Shadowserver & our unique non-profit approach to raising the bar on cybersecurity worldwide by sharing free threat intelligence, supporting LE in disrupting cybercrime & cybersecurity capacity building all around the planet! www.helpnetsecurity.com/2024/12/05/p...

#Socks5Systemz backconnect traffic now uses TCP port 2024 (previously 2023) infosec.exchange/@abuse_ch@io...

Remember the wiper attack against KA-SAT/Viasat during Russia's invasion of Ukraine? Joe (@pylos.co) provides a great overview of this campaign. The talk also covers alignment with #Sandworm, a little-known DHCP DoS attack and risks with satellite comms for ICS/SCADA. youtu.be/0a-qza6YSZA

Entry point is "gobayden" 🤷

Nice malware lab setup using FLARE VM, #PolarProxy and #REMnux to decrypt and inspect TLS traffic. www.koenmolenaar.nl/nl/write-ups...

Erik and Jonas's Network Fingerprinting talk at NetNod. It covers #JA4, #JARM, #p0f, Satori and a few other techniques. www.youtube.com/watch?v=1_Vb...

I just want to say a huge shout out to @netresec.bsky.social, they've always been such a huge support to me and my projects over the years. They create fantastic stuff like Network Miner, go check them out!!

Guest post on the APNIC blog: Three methods to decrypt TLS traffic, how each works, and when to use them. blog.apnic.net/2024/10/14/h...

Two network forensic classes scheduled: 🇺🇸 PCAP in the Morning US October 21-24, 2024 🇪🇺 PCAP in the Morning Europe November 18-21, 2024 netresec.com?b=2462e4f

Our network forensics class next week is almost sold out (2 seats left), but there are a few more available seats in our "PCAP in the Morning US" on March 25-28. You don’t need to be in the US to take this class. Hope to see you there!

Video: Hunting for Cobalt Strike in PCAP netresec.com?b=2410f02

Two new Network Forensics training events! 🇪🇺 PCAP in the Morning Europe, March 4-7 🇺🇸 PCAP in the Morning US, March 25-28 netresec.com?b=23C9979