PolarProxy 2.0.1 Released 💨 Improved performance 🐞 Bug fixes ⚖️ Prioritizes PCAP output over throughput https://netresec.com/?b=266dc11

New release of CapLoader 🫆 JA3/JA4/SNI extraction from multi-segment TLS handshakes 🚨 Alerts on IOCs from @viql's Rösti 👀 OSINT lookup on @jonasl's ScanMalware 📦 Extracts packets from more encapsulation protocols https://netresec.com/?b=265c041

Tell me AI writes your articles without telling me AI writes your articles

PolarProxy 2.0 TLS inspection proxy released 📦 Single self-contained binary release 🔀 Improved HTTP proxy 🐳 Builds for Linux musl (Alpine) ARM/ARM64 🪄 Simplified deployment https://netresec.com/?b=2658a26

Viewing #remcos alerts from FlowCarp in @ish#remcoss #evebox https://netresec.com/?b=2659fc0

Found an odd Telnet like connection in a Mirai malware execution. Follow these steps to see for yourself: `telnet 45.149.186.18 8080` Enter: `newsrv` 🔥 nivela.duckdns[.]org:8080 🔥 45.149.186.18:8080 🔥 b8d37e1ba85e8cebd9802b31747a1689 #mirai #owari

New tool released: FlowCarp 🔍 Identifies protocols without port numbers 🔨 Build protocol detection from example traffic ➡️ Input: PCAP or PcapNG ⬅️ Output: Flows and/or Alerts https://netresec.com/?b=265d268 #flowcarp

Researchers found 8 free and _1 paid_ (!!!) LLM routers actively injecting malicious code and one attempting to steal ETH :bitcoin: > This architecture creates a trust relationship that has received little scrutiny. The “router-in-the-middle” is not an […] [Original post on infosec.exchange]

RE: https://infosec.exchange/@geraldcombs/116133603929246605 Wireshark 4.6.4 resolves 3 denial of service vulnerabilities in the following protocol dissectors: * USB HID (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3201)[CVE-2026-3201] * NTS-KE ( […]

21 of the world's best intelligence and security agencies cannot be wrong... right? https://netresec.com/?b=26233f4

Are CISA typing out their IOC domains by hand? https://netresec.com/?b=26233f4

RE: https://infosec.exchange/@netresec/115905237000922504 This malicious finger service on `64.190.113.206` (AS399629 / BL Networks) has delivered #mintsloader for 30+ days and is still up and running! You can probe it with: `nc 64.190.113.206 79 <<< rcaptcha` The malicious "finger" service […]

We’ve stumbled across an unknown malware C2 protocol. Do you know what this is? 👾 47.83.173.19:5050 👾 47.84.203.73:5050 👾 xuanwcai[.]com:5050 👾 wkaiuahaaxx[.]icu:5050 Characteristic strings in C2 traffic: `Accept: */*` `frAQBc8Wsa1xVPfvJcrgRYwTiizs2tr`

Erik Hjelmvik will run a hands-on network forensic workshop at the upcoming Digital Forensics Research Conference (DFRWS) in Sweden. Participants will get the chance to analyze: 🔪 Packets carved from memory dumps 🧅 Unencrypted Tor traffic […]

RE: https://hachyderm.io/@joew/116007747627635319 FFS why is our blog post on China's Man-on-the-Sida attack against GitHub in the Epstein files?!

Decoding #njrat C2 traffic to extract screenshots, commands and transferred files https://netresec.com/?b=262adb9

Thank you for those kind words! 💜 https://www.linkedin.com/pulse/issue-167-networkminer-soumya-swarup-uqy9c

The early bird discount, for our live online network forensics class, expires by the end of this week. Sign up if you’d like to analyze PCAP files together with Erik Hjelmvik (creator of NetworkMiner and PolarProxy). https://netresec.com/?b=25A2e4f

Decoding malware C2 with #cyberchef https://netresec.com/?b=261f535

🔥 Finger service on 64.190.113.206:79 delivers malicious powershell injects after #clickfix infections. The malicious finger service can be probed with `nc 64.190.113.206 79 <<< rcaptcha`

There's a 10% discount on our live online Network Forensics class if you sign up before January 31. 📅 Dates: February 23-26 (4 days) ⏲️ Time: 13:00 to 17:00 CET (7am to 11am EDT) 💸 Price: € 920 EUR https://netresec.com/?b=25A2e4f

Extracting VNC screenshots and keylog data from #latrodectus 🕷️ BackConnect https://netresec.com/?b=25Cfd08

> Cloudflare's free tier is a gift to threat actors—zero upfront cost, world-class DDoS protection (yes, really), and proxy services that completely mask origin servers. Good luck tracking down the actual host when everything's bouncing through Cloudflare's edge network. This study only covers […]

RE: https://infosec.exchange/@VirusBulletin/115660902138702248 How is this #valleyrat? It looks, swims and quacks like #PureRAT. Here are some typical PureRAT indicators: :windows: .NET malware 🔑 TLS version is 1.0 🫆 JA3 = fc54e0d16d9764783542f0146a98b300 or 07af4aa9e4d215a5ee63f9a0a277fbe3 🫆 […]

NetworkMiner 3.1 Released! 🔑 More usernames, passwords and hostnames extracted :terminal: Better user interface 👾 More details from malware C2 traffic https://netresec.com/?b=25C4039

This #stealc and #castlerat infection starts with a #clickfix attack using finger to download commands from finger[.]cloudyape[.]com

Operation Endgame’s latest phase targeted the infostealer #rhadamanthys, Remote Access Trojan #venomrat, and the botnet #elysium. https://www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down

Monitoring for too many old indicators not only costs money, it can even inhibit detection of real intrusions. 📆 Include "last seen" date when publishing IOCs ❌ Prune old IOCs 📜 Prioritize long lived IOCs over short lived ones https://netresec.com/?b=25Be9dd #threatintel

New network forensics training scheduled! 📅 February 23-26, 2026 ⏲️ 13:00 to 17:00 CET (7am to 11am EDT) 🌍 Live online https://netresec.com/?b=25A2e4f #dfir #training

The technical detail in this PureRAT analysis by Heejae Hwang (황희재) is fantastic! The analyzed #purerat sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.

The use of TLS is pretty much mandatory for HTTP/2, yet this #nezha backoor POSTS HTTP/2 data over TCP port 80 without encryption! 🔥 172.245.52[.]169:80 🔥 c.mid[.]al:80 https://tria.ge/251009-j26bgacj7s https://app.any.run/tasks/952bf595-caf6-4445-b302-513295214e76

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #pseudomanuscrypt and #valleyrat. https://netresec.com/?b=259a5af

Google’s report on #UNC6384 lists this certificate as being used in C2 comms by Sogu (#PlugX variant): eca96bd74fb6b22848751e254b6dc9b8e2721f96 Here’s an @anyrun_app execution, of AdobePlugins.​exe on May 19, which runs CANONSTAGER as well as SOGU.​SEC […] [Original post on infosec.exchange]

Google’s report on #UNC6384 lists this certificate as being used in C2 comms by Sogu (#PlugX variant): eca96bd74fb6b22848751e254b6dc9b8e2721f96 Here’s a sandbox execution, of AdobePlugins.​exe on May 19, which runs CANONSTAGER as well as SOGU.​SEC […] [Original post on infosec.exchange]

Detecting #xenorat C2 connections using example traffic from known malware sample. 🔥 e0b465d3bd1ec5e95aee016951d55640 🔥 5ab23ac79ede02166d6f5013d89738f9 📡 Huy1612-24727.portmap[.]io:24727 📡 193.161.193.99:24727 📡 147.185.221.30:54661 https://netresec.com/?b=258f641

>PureRAT is the exact same malware as what Morphisec and others call ResolverRAT. PureHVNC, on the other hand, is the predecessor to PureRAT. IOCs: 👾 193.26.115.125:8883 👾 purebase.ddns[.]net:8883 👾 45.74.10.38:56001 👾 139.99.83.25:56001 https://netresec.com/?b=2589522

The Secure AI conference is held in Stockholm on September 23-24. > We bring together a community of practitioners, researchers, public sector leaders, and industry experts who understand that security is not an afterthought—it’s a prerequisite. . And without trust and security the AI adoption […]

UPDATE: Turns out the whole /wp-admin/js/ directory on Västkupan's website allows directory listing. Among the files in that directory is "New PO 102456688.exe", which drops #purelogs. 🔥 MD5: b2647b263c14226c62fe743dbff5c70a 🔥 C2: 147.124.219.201:65535 https://netresec.com/?b=257eead

Do #purelogs Stealer and #purecrypter use the same C2 protocol, or is there some way to tell the C2 protocols apart? C2 servers: 🔥 45.141.233.100:7708 🔥 144.172.91.74:7709 🔥 62.60.235.100:9100 🔥 65.108.24.103:62050 🔥 91.92.120.102:62050 🔥 192.30.240.242:62520

Two more #purelogs Stealer DLL files found on vastkupan[.]com. The original blog post has been updated. https://netresec.com/?b=257eead

PureLogs Forensics 💧 Dropper connects to legitimate website 📄 A fake PDF is downloaded over HTTPS 💾 The fake PDF is decrypted to a #purelogs DLL ⚙️ InstallUtil.exe or RegAsm.exe is started. 💉 PureLogs DLL is injected into the running process 👾 PureLogs connects to C2 server IOC List 🔥 91.92.120 […]

CapLoader 2.0.1 Released ⚠️ IP lookup alert 🔎 Better protocol identification 🐛 Bug fixes https://netresec.com/?b=2571527

Signed malicious Connect Wise Control installers hosted on Cloudflare R2 storage (by @lawrenceabrams) https://www.bleepingcomputer.com/news/security/hackers-turn-screenconnect-into-malware-using-authenticode-stuffing/

Why does CloudFlare insist on forwarding abuse reports to hosting providers and website owners? This makes no sense if the website operators and possibly also hosting providers are the criminals you're trying to stop!

Researchers uncover how the Facebook app used localhost STUN communication with the browser to track visited websites in Covert Web-to-App Tracking via Localhost on Android. This trick works even if the user browses in incognito mode and uses a VPN. > The […] [Original post on infosec.exchange]

Video: Detecting #purelogs traffic with #CapLoader https://netresec.com/?b=256a8c4

BKA names identity of the suspected boss of the Trickbot gang https://www.heise.de/en/news/BKA-names-identity-of-the-suspected-boss-of-the-Trickbot-gang-10421313.html?utm_source=flipboard&utm_medium=activitypub Posted into heise online in English @heise-online-in-english-heiseonline

CapLoader 2.0 released today! 🔎 Identifies over 250 protocols in #pcap 🎨 Define protocols from example traffic 🇶 Extracts JA3, JA4 and SNI from QUIC 💻 10x faster user interface https://netresec.com/?b=256dbbc

Thank you CISA, NCSC, @bsi et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting! #threathunting #threatintel

DoJ, Dutch National Police and FBI have dismantled a botnet that was used to run Anyproxy and 5socks proxy networks. https://www.theregister.com/2025/05/10/router_botnet_crashed/