@netresec

Creators of #NetworkMiner, #CapLoader, #PolarProxy, #FlowCarp and #RawCap. https://xitter.cf/t.co/CZliuI7uGK https://xitter.cf/t.co/vC5XlufvIJ

 @[email protected]
netresec.com/
Joined November 2011
  • Tweets3.7K
  • Following878
  • Followers8.9K
537Media
Netresec is @[email protected] on Mastodon: infosec.exchange/@netresec

π™½π™΄πšƒπšπ™΄πš‚π™΄π™² (@[email protected])

591 Posts, 679 Following, 1.28K Followers Β· Experts in Network Forensics and Network Security Monitoring. Creators of #NetworkMiner, #CapLoader, #PolarProxy, #FlowCarp and #RawCap. #PCAP or it didn't...

infosec.exchange
1
1
1
787
CapLoader 2.2 is here! 🚨 New alert types for abused services ⬆️ Navigate flow transcripts with the arrow keys 🎨 Alert severity row coloring πŸ”Ž Better BPF filter feedback netresec.com/?b=26A4762

CapLoader 2.2 Released

CapLoader 2.2 adds new alerts for services and infrastructure that may be abused, makes flow transcripts easier to navigate and improves alert-based coloring. It also includes more helpful BPF filter...

netresec.com
4
10
603
Atlas RAT C2 protocol evolution: 1⃣ November 2025: SFuck check-in and cleartext C2 headers 2⃣ March 2026: XOR encrypted C2 headers 3⃣ May 2026: BFuck check-in 4⃣ July 2026: C2 over TLS
π™½π™΄πšƒπšπ™΄πš‚π™΄π™²@netresecOct 12
New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS πŸ“‘ 23.226.57.50:443 πŸ“‘ 38.76.177.46:443 πŸ“‘ 43.99.101.175:443 πŸ“‘ 45.142.152.180:443 πŸ“‘ 116.204.169.70:443 πŸ“‘ 150.158.50.175:443 πŸ“‘ 156.234.7.48:443 πŸ“‘ 192.252.180.45:443 netresec.com/?b=26A6cc8

Detecting AtlasRAT C2

Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol. Earlier versions started with a distinctive byte sequence: 53 46 75 63 6b 00 00 00 In ASCII, that is...

netresec.com
2
1
3
512
New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS πŸ“‘ 23.226.57.50:443 πŸ“‘ 38.76.177.46:443 πŸ“‘ 43.99.101.175:443 πŸ“‘ 45.142.152.180:443 πŸ“‘ 116.204.169.70:443 πŸ“‘ 150.158.50.175:443 πŸ“‘ 156.234.7.48:443 πŸ“‘ 192.252.180.45:443 netresec.com/?b=26A6cc8

Detecting AtlasRAT C2

Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol. Earlier versions started with a distinctive byte sequence: 53 46 75 63 6b 00 00 00 In ASCII, that is...

netresec.com
11
3
20
4,706
NetworkMiner 3.2 Released πŸ”‘ RADIUS authentication extraction 🏭️ Better OT/ICS protocol parsers for UMAS and IEC-104 πŸ“‚ Improved file extraction from PCAP netresec.com/?b=26Aa0d3

NetworkMiner 3.2 Released

NetworkMiner 3.2 parses RADIUS authentication data and extracts more details from the OT/ICS protocols UMAS and IEC-104. The release also improves several existing protocol parsers and fixes file-r...

netresec.com
11
1
28
1,694
Your SOC deserves better alerts. FlowCarp helps uncover network activity that traditional detection may miss. netresec.com/?b=26A42c0

Stop Feeding the SOC Garbage

Security operations teams are handling increasing volumes of network events and security alerts. Whether those alerts are reviewed by human analysts, processed by AI, or handled through a combination...

netresec.com
2
10
860
π™½π™΄πšƒπšπ™΄πš‚π™΄π™² retweeted
FBI Cyber Division
@FBICyberDivSep 29
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world. The Dutch High-Tech Crime Unit arrested the suspect under Dutch law. That's exactly how the "best athlete" model in the new FBI Cyber Strategy is meant to work: the partner with the strongest authority and access leads. The @FBI is grateful to everyone who has assisted us in the ShinyHunters investigation, especially the Dutch National Police and the industry partners who shared information with us.
76
324
45
1,389
172,934
It's time to start blocking traffic to workers[.]dev. At least run it through a TLS-inspection proxy before forwarding it to this free malware C2 hosting platform provided by Cloudflare. infosec.exchange/@netresec/1…

π™½π™΄πšƒπšπ™΄πš‚π™΄π™² (@[email protected])

@james_inthe_box πŸ”₯ hxxps://billowing-boat-0c0f.piloty194.workers[.]dev

infosec.exchange
1
9
1
35
3,126
Malware family identification is hard, especially when samples are packed, encrypted or poorly classified. FlowCarp can help identify the correct malware family and reduce alert overlap. netresec.com/?b=2692109

Unmasking Malware Families

Identifying malware families is hard. Malware samples are often packed, strings encrypted and configurations may only appear after several stages of execution. Even experienced reverse engineers can...

netresec.com
1
36
172
6,310
PolarProxy 2.0.2 is out! 🧦 SOCKS proxy tunneling πŸ…ΏοΈ Environment variable support βŒ›οΈ Improved timeouts πŸ“œ SBOM for supply chain transparency netresec.com/?b=2692ad6

PolarProxy 2.0.2 Released

A few more handy features have been added to PolarProxy, our TLS inspection proxy. PolarProxy can now tunnel outgoing connections through SOCKS proxies and supports environment variables as an...

netresec.com
1
7
461
"For years, we ranked our adversaries in a stack. I call it the OSI stack. It came to me in a dream." β€” George Kurtz, CEO of CrowdStrike infosec.exchange/@DavidJBian…

David J. Bianco (He/Him) (@[email protected])

Attached: 2 images Feel free to call it whatever you like, I guess? #PyramidOfPain

infosec.exchange
5
700
OT networks still need monitoring. We examine the Polish CHP plant hack and show how better network security monitoring could have detected the attackers before they carried out destructive actions. netresec.com/?b=2686c28

OT Networks Still Need Monitoring

CERT Polska recently published a follow-up report detailing the hack of a Polish combined heat and power (CHP) plant in December 2025. CERT Polskas report concludes with several important recommend...

netresec.com
2
1
356
New blog post: #CNCMachineRMS C2 Protocol We analyze the malware’s binary C2 protocol, DoH usage, related infrastructure and network detection opportunities. netresec.com/?b=268ee19

CNCMachineRMS C2 Protocol

This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastru...

netresec.com
2
12
1
36
2,441
Sorting out false positives of IOCs labeled as #zgRAT. Turns out they were #PureRAT and #PureMiner. infosec.exchange/@netresec/1…

π™½π™΄πšƒπšπ™΄πš‚π™΄π™² (@[email protected])

Attached: 1 image Only 3 IOCs have been posted to ThreatFox for the confusing catch-all label `zgRAT` in the past 12 months. Let's clear up any issues and figure out what they actually are. `89.23....

infosec.exchange
3
2
496
zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT. netresec.com/?b=267e877
3
2
6
1,406
Pivoting on hashes and IPs ➑️ Ping32 RMM and ValleyRAT πŸ‘Ύ d43fdaa1f0ee09d7e5f0f94ee9df7b6c πŸ“‘ 143.92.37.168:18987 (UDP) πŸ‘Ύ 8266b00c4e45d728cef78b3f5a865f68 πŸ“‘ 143.92.37.168:10086 (UDP) netresec.com/?b=2666e31

Ping32 RMM and ValleyRAT

Fareed Radzi recently blogged about a malware campaign observed earlier in June by Kasperskys GReAT team. The malware campaign embedded malicious code in VBScripts, which were distributed through...

netresec.com
8
13
1,716
Is this a new ValleyRAT variant from SilverFox (铢狐) or a completely new malware? Custom protocol over TCP 443. C2 traffic starts with: "BFuck" (42 46 75 63 6b 00 00 00) IOCs: πŸ‘Ύ 38.76.177.46:443 πŸ‘Ύ 43.99.101.175:443 infosec.exchange/@netresec/1…

π™½π™΄πšƒπšπ™΄πš‚π™΄π™² (@[email protected])

Attached: 1 image Is this a new ValleyRAT variant from #SilverFox (铢狐) or a completely new malware? Custom protocol over TCP 443. C2 traffic starts with `BFuck\0\0\0` = `42 46 75 63 6b 00 00 00`...

infosec.exchange
1
7
55
3,811
tria.ge/260527-lq3gjscw4t tria.ge/260525-t6jclsdv5m
620
Maximizing IOC Impact: Advice on extracting, verifying, and sharing IOCs for fast, broad protection. netresec.com/?b=26653f3

Maximizing IOC Impact

Ive been thinking about threat intelligence lately. Specifically: indicators of compromise (IOC), how and where to share them to cause maximum pain to adversaries and help as many organizations as...

netresec.com
1
2
5
1,345
How do You maximize IOC sharing with minimal effort?
1
2
657
π™½π™΄πšƒπšπ™΄πš‚π™΄π™² retweeted
Huntress
@HuntressLabsJun 4
The whole chain barely touches disk. HTML β†’ JScript β†’ PowerShell β†’ .NET loader β†’ RAT, nearly all in memory. Full writeup and IOCs from @RussianPanda9xx and Adam Mooney. okt.to/R5z6Zx

Inside .NET Loader Analysis: From Malspam to In-Memory Loader | Huntress

A malspam campaign abusing Google's DoubleClick delivers the loader through a five-stage chain that evades detection and blinds Windows telemetry before persisting

huntress.com
2
7
21
2,118
Load more