C2 Archives - CyberConvoy Blog

SonicWall devices infected by malware that survives firmware upgrades

03/10/2023
Cyber News
Breach, C2, Hardening, Malware, Patching

The deployed malware is customized for SonicWall devices and is used to steal user credentials, provide shell access to the attackers, and even persist through firmware upgrades

10 March

Hackers start using Havoc post-exploitation framework in attacks

02/16/2023
Cyber News
C2, Hacking, Security

It bypasses Microsoft Defender on up-to-date Windows 11 devices using sleep obfuscation, return address stack spoofing, and indirect syscalls

16 February

Hundreds of Microsoft SQL servers backdoored with new malware

10/08/2022
Cyber News
Brute Force, C2, Exploit, Hacking, Malware, PrivEsc, RCE, Security

Maggie's capabilities extend to brute-forcing administrator logins to other Microsoft SQL servers

8 October

New malware backdoors VMware ESXi servers to hijack virtual machines

10/01/2022
Cyber News
Breach, C2, Exploit, Hacking, Malware, Patching

With the help of malicious vSphere Installation Bundles, the attacker could install on the bare-metal hypervisor two backdoors

1 October

VMware, Microsoft warn of widespread Chromeloader malware attacks

09/21/2022
Cyber News
Breach, C2, Exploit, Hacking, PrivEsc, Ransomware, RCE, Security

Because adware doesn't create notable damage to victims' systems, besides eating up some bandwidth, it is usually a threat that is ignored or downplayed by analysts

21 September

Emotet botnet now pushes Quantum and BlackCat ransomware

09/19/2022
Cyber News
C2, Exploit, Hacking, Malware, Phishing, PrivEsc, Ransomware

The botnet is now being used to install a Cobalt Strike beacon on infected systems as a second-stage payload

19 September

New Stealthy Shikitega Malware Targeting Linux Systems and IoT Devices

09/10/2022
Cyber News
C2, Malware, PrivEsc

The exact method by which the initial compromise is achieved remains unknown as yet, but what makes Shikitega evasive is its ability to download next-stage payloads from a command-and-control (C2) server and execute them directly in memory.

10 September

Windows malware delays coinminer install by a month to evade detection

08/30/2022
Cyber News
C2, Malware

To avoid raising suspicions and to thwart sandbox analysis, the software activates a dropper from another encrypted RAR file fetched via Wget on the fifth day of the infection.

30 August

Cybercrime Groups Increasingly Adopting Sliver Command-and-Control Framework

Sliver presents an attractive alternative for threat actors looking for a lesser-known attack toolset with a low barrier for entry

26 August