𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲

netresec.comCapLoader 2.2 ReleasedCapLoader 2.2 adds new alerts for services and infrastructure that may be abused, makes flow transcripts easier to navigate and improves alert-based coloring. It also includes more helpful BPF filter ...

CapLoader 2.2 is here! 🚨 New alert types for abused services ⬆️ Navigate flow transcripts with the arrow keys 🎨 Alert severity row coloring 🔎 Better BPF filter feedback netresec.com?b=26A4762

netresec.comDetecting AtlasRAT C2Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol. Earlier versions started with a distinctive byte sequence: 53 46 75 63 6b 00 00 00 In ASCII, that is SFuck...

Atlas RAT C2 protocol evolution: 1️⃣ November 2025: SFuck check-in and cleartext C2 headers 2️⃣ March 2026: XOR encrypted C2 headers 3️⃣ May 2026: BFuck check-in 4️⃣ July 2026: C2 over TLS

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲@netresec.com

New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS 📡 23.226.57.50:443 📡 38.76.177.46:443 📡 43.99.101.175:443 📡 45.142.152.180:443 📡 116.204.169.70:443 📡 150.158.50.175:443 📡 156.234.7.48:443 📡 192.252.180.45:443 netresec.com?b=26A6cc8

NetworkMiner 3.2 Released 🔑 RADIUS authentication extraction 🏭 Better OT/ICS protocol parsers for UMAS and IEC-104 📂 Improved file extraction from PCAP netresec.com?b=26Aa0d3

netresec.comNetworkMiner 3.2 ReleasedNetworkMiner 3.2 parses RADIUS authentication data and extracts more details from the OT/ICS protocols UMAS and IEC-104. The release also improves several existing protocol parsers and fixes file-reas...

netresec.comStop Feeding the SOC GarbageSecurity operations teams are handling increasing volumes of network events and security alerts. Whether those alerts are reviewed by human analysts, processed by AI, or handled through a combination ...

Your SOC deserves better alerts. FlowCarp helps uncover network activity that traditional detection may miss. netresec.com?b=26A42c0

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

Nicholas Grossman

@nicholasgrossman.bsky.social

Computer crimes are already illegal. I do not think “we knowingly deployed software we can’t control” is a legitimate defense against break those laws.

netresec.comUnmasking Malware FamiliesIdentifying malware families is hard. Malware samples are often packed, strings encrypted and configurations may only appear after several stages of execution. Even experienced reverse engineers can g...

21 Sept

Malware family identification is hard, especially when samples are packed, encrypted or poorly classified. FlowCarp can help identify the correct malware family and reduce alert overlap. netresec.com?b=2692109

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

Saher

@saffronsec.bsky.social

9 Sept

Exploits, zero-days, robots, oh my! New research from @threatinsight.proofpoint.com on multiple China-aligned actors using an exploit chain with Chrome (patch-gap) and Windows zero-days and indicators of AI-assisted development. Meet BlueMoon exploit kit: www.proofpoint.com/us/blog/thre...

proofpoint.comOnce in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint USAnalyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation.

netresec.comPolarProxy 2.0.2 ReleasedA few more handy features have been added to PolarProxy, our TLS inspection proxy. PolarProxy can now tunnel outgoing connections through SOCKS proxies and supports environment variables as an alterna...

8 Sept

PolarProxy 2.0.2 is out! 🧦 SOCKS proxy tunneling 🅿️ Environment variable support ⌛️ Improved timeouts 📜 SBOM for supply chain transparency netresec.com?b=2692ad6

netresec.comOT Networks Still Need MonitoringCERT Polska recently published a follow-up report detailing the hack of a Polish combined heat and power (CHP) plant in December 2025. CERT Polskas report concludes with several important recommendati...

31 Aug

OT networks still need monitoring. We examine the Polish CHP plant hack and show how better network security monitoring could have detected the attackers before they carried out destructive actions. netresec.com?b=2686c28

netresec.comCNCMachineRMS C2 ProtocolThis post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructu...

21 Aug

New blog post: #CNCMachineRMS C2 Protocol We analyze the malware’s binary C2 protocol, DoH usage, related infrastructure and network detection opportunities. netresec.com?b=268ee19

netresec.comPureLogs, PureRAT and misleading zgRATPlease stop classifying malware as zgRAT. That malware label is confusing. As far as I know, there isnt a proper definition of what zgRAT actually is. Some claim that zgRAT is the same malware family ...

27 July

zgRAT is a confusing catch-all label: both #PureLogs and #PureRAT commonly trigger "zgRAT" detections. Please don't label malware as #zgRAT. netresec.com?b=267e877

netresec.comPing32 RMM and ValleyRATFareed Radzi recently blogged about a malware campaign observed earlier in June by Kasperskys GReAT team. The malware campaign embedded malicious code in VBScripts, which were distributed through What...

25 June

Pivoting on hashes and IPs ➡️ Ping32 RMM and ValleyRAT 👾 d43fdaa1f0ee09d7e5f0f94ee9df7b6c 📡 143.92.37.168:18987 (UDP) 👾 8266b00c4e45d728cef78b3f5a865f68 📡 143.92.37.168:10086 (UDP) netresec.com?b=2666e31

netresec.comMaximizing IOC ImpactIve been thinking about threat intelligence lately. Specifically: indicators of compromise (IOC), how and where to share them to cause maximum pain to adversaries and help as many organizations as pos...

8 June

Maximizing IOC Impact: Advice on extracting, verifying, and sharing IOCs for fast, broad protection. netresec.com?b=26653f3

8 June

How do You maximize IOC sharing with minimal effort?

netresec.comPolarProxy 2.0.1 ReleasedOur TLS inspection proxy PolarProxy has been updated with bug fixes, improved performance and more reliable PCAP output. The recent PolarProxy 2.0 release added musl/Alpine compatibility and support f...

5 June

PolarProxy 2.0.1 Released 🐻‍❄️ 💨 Improved performance 🐞 Bug fixes ⚖️ Prioritizes PCAP output over throughput netresec.com?b=266dc11

netresec.comCapLoader 2.1.0 ReleasedCapLoader has been updated to version 2.1.0. The new release comes with better JA3/JA4 extraction and integration of additional threat-intel and OSINT services. We have also added support for more enc...

27 May

New release of CapLoader 🫆 JA3/JA4/SNI extraction from multi-segment TLS handshakes 🚨 Alerts on IOCs from Rösti (rosti.dev) 👀 OSINT lookup on BGP.Tools/IPinfo/Netify/ScanMalware 📦️ Extracts packets from more encapsulation protocols netresec.com?b=265c041

22 May

Tell me ChatGPT writes your articles without telling me ChatGPT writes your articles

netresec.comPolarProxy 2.0 ReleasedA new major release of PolarProxy is out with a self-contained single-file binary, expanded platform support (musl/ARM), and improved container and service plumbing. PolarProxy is a transparent TLS/SS...

18 May

PolarProxy 2.0 TLS inspection proxy released 📦️ Single self-contained binary release 🔀 Improved HTTP proxy 🐳 Builds for Linux musl (Alpine) ARM/ARM64 🪄 Simplified deployment netresec.com?b=2658a26

netresec.comRemcos Alerts from FlowCarp in EveBoxThere is a wonderful little web based alert and event front-end called EveBox, which renders Eve JSON formatted data to a graphical user interface. This blog post demonstrates how EveBox can be used t...

8 May

Viewing #remcos alerts from FlowCarp in @unx.ca's #EveBox netresec.com?b=2659fc0

netresec.comFlowCarp Identifies ProtocolsI am thrilled to announce the release of a brand new tool called FlowCarp! FlowCarp is a simple command line tool that performs a very complicated task. It identifies the application layer protocol in...

4 May

New tool released: FlowCarp 🔍 Identifies protocols without port numbers 🔨 Build protocol detection from example traffic ➡️ Input: PCAP or PcapNG ⬅️ Output: Flows and/or Alerts netresec.com?b=265d268

19 Mar

This "JWT_SESSION" cookie sure looks funky, with base64 encoded data between "metaPrefix" and "metaSuffix"! 🔥 66.234.147.10:8080

StrikeReady Labs @strikereadylabs.com

susp #redteam OSCE_Election_Security_Checklist_v2.pdf.exe 600710c6ad0e4260a3879d36c5455e71 66.234.147.10

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

DFRWS

@dfrws.bsky.social

10 Mar

✨ DFRWS EU 2026 Workshops Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations. 📍 Workshop Dates 23–24 March 2026 🧿 Details here: buff.ly/oT8OtbE #MemoryForensics #PCAP #TOR

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

DFRWS

@dfrws.bsky.social

5 Mar

✨DFRWS EU 2026 Workshops All DFRWS #Workshops and Social Events are inclusive in Registration. 👍 📍 Workshop Dates 23–24 March 2026 📍 Hybrid • Linköping, Sweden Explore workshop details 👉 buff.ly/Q45nyji Register 👉 buff.ly/lsQrqiZ #NetworkTrafficAnalysis #MemoryForensics #DFIR #TorAnalysis

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

Europol

@europol.europa.eu

4 Mar

🔐 A major phishing-as-a-service platform disrupted. Tycoon2FA enabled large-scale account compromise by bypassing MFA protections. Through Europol’s Cyber Intelligence Extension Programme, industry intelligence was turned into operational results. Read more here: https://ow.ly/GECE50YoZIO

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

Snorre Fagerland

@snoffle.bsky.social

1 Mar

I'm interested in getting in touch with anyone who was involved in the WANK/OILZ worm outbreak at NASA/CERN/DoE in 1989. I've talked to a few folks, but there are still blanks in this story - if you were part of that please ping me.

27 Feb

21 of the world's best intelligence and security agencies cannot be wrong... right? netresec.com?b=26233f4

netresec.comCISA mixup of IOC domainsGoogles Threat Intelligence Group (GTIG) and Mandiants recent Disrupting the GRIDTIDE Global Cyber Espionage Campaign report is great and it has lots of good Indicators of Compromise (IOC). Many of th...

27 Feb

netresec.com?b=26233f4

netresec.comCISA mixup of IOC domainsGoogle's Threat Intelligence Group (GTIG) and Mandiant's recent Disrupting the GRIDTIDE Global Cyber Espionage Campaign report is great and it has lots of good Indicators of Compromise (IOC). ...

26 Feb

Do CISA analysts type out IOC domains by hand? netresec.com?b=26233f4

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

Erik Hjelmvik will run a hands-on network forensic workshop at the upcoming Digital Forensics Research Conference in Sweden. Participants will get the chance to analyze: 🔪 Packets carved from memory dumps 🧅 Unencrypted Tor traffic dfrws.org/dfrws-eu-202...

dfrws.orgDFRWS EU 2026 Workshop – Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic - DFRWS

This post is unavailable.

netresec.comnjRAT runs MassLoggernjRAT is a remote access trojan that has been around for more than 10 years and still remains one of the most popular RATs among criminal threat actors. This blog post demonstrates how NetworkMiner Pr...

2 Feb

Decoding #njRAT C2 traffic to extract screenshots, commands and transferred files netresec.com?b=262adb9

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

Joe Slowik

@pylos.co

31 Jan

Some initial thoughts on recent disclosures concerning the December 2025 incident targeting the Polish electric sector - with a focus on #CTI elements such as attribution implications and methodology: pylos.co/2026/01/31/a...

pylos.coAttributive Questions in High Profile IncidentsOn 30 January 2026, CERT.PL published findings concerning an electric sector attack on Poland in December 2025. This report, presumably the most complete on the incident covering multiple sources a…

27 Jan

Thank you for those kind words! 💜 www.linkedin.com/pulse/issue-...

netresec.comOnline Network Forensics ClassI will teach a live online network forensics training on February 23-26. The full title of the class is Network Forensics for Incident Response, where we will analyze PCAP files containing network tra...

26 Jan

The early bird discount, for our live online network forensics class, expires by the end of this week. Sign up if you’d like to analyze PCAP files together with Erik Hjelmvik (creator of NetworkMiner and PolarProxy). netresec.com?b=25A2e4f

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

DFRWS

@dfrws.bsky.social

21 Jan

DFRWS EU 2026 is seeking posters showcasing interesting digital forensics research for presentation in Linköping, Sweden, 24–27th March 2026. 📥 Submit via EasyChair (PDF) - Rolling notification until the program is full! #DFRWSEU2026 #DFRWS #DigitalForensics

netresec.comDecoding malware C2 with CyberChefThis video tutorial demonstrates how malware C2 traffic can be decoded with CyberChef. The PCAP files with the analyzed network traffic can be downloaded from malware-traffic-analysis.net. CyberChef r...

20 Jan

🎬 Video: Decoding malware C2 with #CyberChef netresec.com?b=261f535

netresec.comLatrodectus BackConnectI recently learned that the great folks from The DFIR Report have done a writeup covering the Latrodectus backdoor. Their report is titled From a Single Click: How Lunar Spider Enabled a Near Two-Mont...

Extracting VNC screenshots and keylog data from #Latrodectus 🕷️ BackConnect netresec.com?b=25Cfd08

Keylog of attacker's hands-on keyboard actions from BackConnect VNC session

Big thank you to @thedfirreport.bsky.social for capturing this intrusion traffic! 🎉

Extracting VNC screenshots and keylog data from #Latrodectus 🕷️ BackConnect netresec.com?b=25Cfd08

Here's one of the screenshots from the BackConnect VNC sessions in the blog post

netresec.comNetworkMiner 3.1 ReleasedThis NetworkMiner release brings improved extraction of artifacts like usernames, passwords and hostnames from network traffic. We have also made some updates to the user interface and continued our e...

1 Dec 2025

NetworkMiner 3.1 Released! 🔑 More usernames, passwords and hostnames from #PCAP 💻 Improved user interface 👾 Better details from malware C2 traffic netresec.com?b=25C4039

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

StrikeReady Labs

@strikereadylabs.com

20 Nov 2025

CN #APT targeting attendees of a diabetes conference in Singapore in December attd.z23.web.core[.]windows[.]net/ATTD-ASIA-2025.zip (live link, careful!) ATTD-ASIA-2025.lnk a12357ff6c0f7b021f32b0c9cd3d01c4 ATTD-ASIA-2025.zip a8082a80cef9ccee9d7a35f5366e3afb gzv.msi 32e7dcbd26b6455974d5b2c52c3ca421 🐴

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

David J. Bianco

@davidjbianco.bsky.social

6 Nov 2025

I love the idea of calculating the decay rate of an IOC. It's not always strictly mathematical, because it also relies on threat actors' choices about how they use the IOCs, but as an estimate and for decision making, this seems promising. Also, I really like @netresec.com's ASCII art Pyramid. 😀

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲@netresec.com

Monitoring for too many old indicators not only costs money, it can even inhibit detection of real intrusions. 📆 Include "last seen" date when publishing IOCs ❌ Prune old IOCs 📜 Prioritize long lived IOCs over short lived ones netresec.com?b=25Be9dd

netresec.comOptimizing IOC Retention TimeAre you importing indicators of compromise (IOC) in the form of domain names and IP addresses into your SIEM, NDR or IDS? If so, have you considered for how long you should keep looking for those IOCs...

𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 reposted

🚨 The #DFRWSEU 2026 paper submission deadline has been extended to 10th October 2025 🎉 Submit your paper showcasing cutting-edge digital forensics research. 📤 Submit here: buff.ly/BN8Jlnb ℹ️ Conference details: buff.ly/KOw9Xpr #DFRWS #DigitalForensics #CFP

netresec.comGh0stKCP ProtocolGh0stKCP is a command-and-control (C2) transport protocol based on KCP. It has been used by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyR...

24 Sept 2025

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #PseudoManuscrypt and #ValleyRAT. netresec.com?b=259a5af