In early May 2025, security teams began observing a sudden rise in post-exploitation activity leveraging an open-source command-and-control framework known as AdaptixC2.

Originally developed to assist penetration testers, this framework offers a range of capabilities—file system manipulation, process enumeration, and covert channel tunneling—that have now been adopted by malicious actors.

The framework’s modular design and extensibility through “extenders” make it particularly attractive for adversaries seeking a customizable toolkit that can evade traditional defenses.

Palo Alto Networks researchers noted that AdaptixC2 remained largely under the radar until threat intelligence feeds began reporting infections across multiple sectors.

One early campaign relied on social engineering via fake help desk remote support requests, tricking users into executing Quick Assist sessions that unleashed a multi-stage PowerShell loader.

Within minutes, adversaries achieved in-memory execution of the beacon without dropping any files, sidestepping endpoint detection measures and establishing persistent control over the victim host.

As incidents proliferated, a different cluster of intrusions emerged involving AI-generated scripts designed to deploy AdaptixC2.

Palo Alto Networks analysts identified stylistic markers—numbered comments and verbose output confirmations—that pointed to code produced by large language models.

These scripts not only downloaded and decrypted a Base64-encoded payload, but also used .NET’s GetDelegateForFunctionPointer to execute shellcode directly in memory.

By leveraging built-in Windows APIs such as VirtualProtect and CreateProcess, attackers achieved stealthy deployment and reliable persistence.

Across both scenarios, the impact has been significant. Compromised environments have seen lateral movement facilitated by SOCKS4/5 tunneling and port forwarding, enabling data exfiltration in small chunks to blend with normal traffic patterns.

In one documented case, adversaries combined AdaptixC2 with Fog ransomware in an attack against a financial institution in Asia, demonstrating the framework’s versatility and potential to amplify downstream payloads.

Organizations relying on legacy detection systems found themselves ill-prepared for this modular, evolving threat.

The graphical view of linked agents and sessions, highlighting how attackers map available targets and plan multi-stage operations.

The encrypted configuration parameters—RC4-encrypted payloads stored alongside their keys in the PE header—allowing rapid customization of communication profiles.

Infection Mechanism via Fileless PowerShell Loader

One of the most insidious elements of AdaptixC2 deployment is its fileless infection mechanism, executed entirely in memory to evade disk-based defenses.

The initial vector often begins with a seemingly innocuous PowerShell script, delivered through a social engineering email or remote support prompt.

Upon execution, the script invokes Invoke-RestMethod to retrieve a Base64-encoded shellcode payload from a legitimate cloud storage service.

It then decodes this payload and calls VirtualAlloc to allocate a memory region with PAGE_EXECUTE_READWRITE permissions.

Using reflection and dynamic invocation, the loader constructs a delegate pointing to the shellcode entry point:-

var ptr = GetDelegateForFunctionPointer(shellcodePtr, typeof(Action));
((Action)ptr)();

This method sidesteps the need for written executables, leaving minimal forensic artifacts. Following successful execution, the script employs CreateShortcut in the user’s Startup folder or writes a Run key to the registry under a familiar name such as “Updater,” ensuring that the beacon survives reboots.

Detection evasion is further enhanced by configurable KillDate and WorkingTime parameters, which limit beacon activity to pre-defined windows, and by customizable user-agent strings and HTTP headers.

Security teams must therefore enrich telemetry with memory-based detections and network-behavior analytics to intercept these in-flight payloads before they fully establish their C2 channels.

Continuous monitoring for dynamic invocation APIs and anomalous PowerShell child processes remains critical to disrupting this modern, fileless infection chain.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Threat Actors Leveraging Open-Source AdaptixC2 in Real-World Attacks appeared first on Cyber Security News.

In early March 2025, security teams first observed an unprecedented L7 DDoS botnet targeting web applications across multiple sectors.

The botnet, rapidly expanding from an initial 1.33 million compromised devices, employed HTTP GET floods to exhaust server resources and circumvent traditional rate limiting.

By mid-May, the threat escalated as the botnet grew to 4.6 million nodes, leveraging compromised IoT devices and poorly secured endpoints to amplify its attack surface.

By September, this sprawling network had mobilized 5.76 million IP addresses for a coordinated assault on a government organization, generating tens of millions of requests per second.

Qrator Labs analysts noted significant shifts in geographical distribution, with Brazil, Vietnam, and the United States emerging as major sources of malicious traffic.

The attack unfolded in two waves: an initial surge engaging approximately 2.8 million devices, followed an hour later by an additional 3 million nodes.

HTTP headers in the second wave revealed randomized User-Agent strings designed to evade simple traffic filtering.

Qrator Labs researchers identified key adaptations in the botnet’s control mechanism that facilitated its rapid scaling.

The malware communicates over encrypted channels with a decentralized command-and-control (C2) infrastructure, which the attackers rotate frequently to avoid blacklisting.

Signature-based mitigation struggled to keep pace as each C2 endpoint was active for mere hours before rotation.

Infection Mechanism and Persistence

The core infection vector relies on brute-force exploitation of default credentials and unpatched vulnerabilities in common IoT firmware.

Once inside a device, the malware deploys a lightweight rootkit that hooks into network interfaces and intercepts firmware update routines.

A code snippet extracted by Qrator Labs illustrates the persistence strategy:-

// Intercept firmware update calls
int hook_update(char *path) {
    if (!strcmp(path, "/usr/bin/fw_update")) {
        launch_payload();
        return 0;
    }
    return orig_update(path);
}

This approach ensures the malicious modules reload after each system restart, rendering simple reboot-based remediation ineffective.

The stealthy rootkit also suppresses suspicious process listings, further complicating detection and removal.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post L7 DDoS Botnet Hijacked 5.76M Devices to Launch Massive Attacks appeared first on Cyber Security News.

Four Kenyan filmmakers became victims of sophisticated surveillance when FlexiSPY spyware was covertly installed on their devices while in police custody, according to forensic analysis conducted by the University of Toronto’s Citizen Lab.

The incident occurred on or around May 21, 2025, after authorities seized the devices during arrests connected to allegations surrounding the BBC documentary “Blood Parliament.”

The filmmakers—MarkDenver Karubiu, Bryan Adagala, Nicholas Wambugu, and Christopher Wamae—were arrested on May 2 at a Nairobi studio on charges of publishing false information.

Though released without charges the following day, their electronic devices remained in police custody until July 10, providing a window for the unauthorized spyware installation.

CPJ analysts noted that the FlexiSPY installation represents a significant breach of journalistic privacy and security.

The commercially available surveillance tool grants operators comprehensive access to victims’ digital communications, including real-time monitoring of messages, emails, and social media activities.

Senior researcher John Scott-Railton emphasized that the spyware provides “silent, secret access to all sorts of private business and information about their journalism.”

FlexiSPY markets itself as a monitoring solution for parents and employers, advertising capabilities that extend far beyond basic surveillance.

The software can record phone calls, track device locations and website visits, capture passwords, download photos and videos, and even activate device microphones for environmental listening.

This comprehensive surveillance capability makes it particularly concerning when deployed against journalists and media professionals.

Advanced Persistence and Monitoring Capabilities

The FlexiSPY spyware demonstrates sophisticated persistence mechanisms designed to maintain long-term access to compromised devices.

Once installed, the malware operates stealthily in the background, continuously transmitting data to remote servers while avoiding detection by standard security measures.

The software’s architecture allows it to survive device reboots and resist removal attempts through hidden system-level integration.

The spyware’s monitoring capabilities extend to encrypted messaging platforms, potentially compromising secure communications that journalists rely upon for source protection.

By intercepting data before encryption occurs at the application level, FlexiSPY can capture sensitive information that would otherwise remain protected.

This functionality poses particular risks for investigative journalists who depend on confidential communications with sources and colleagues.

The incident highlights growing concerns about state surveillance of media professionals and the weaponization of commercial spyware against press freedom advocates worldwide.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Kenyan Filmmakers Installed With FlexiSPY Spyware That Monitors Messages and Social Media appeared first on Cyber Security News.

A previously unknown advanced persistent threat (APT) group has unleashed a new fileless malware framework, dubbed EggStreme, in a highly targeted espionage campaign against strategic organizations.

Emerging in early 2024, EggStreme exploits the legitimate Windows Mail executable (WinMail[.]exe) to sideload a malicious library, allowing attackers to achieve in-memory code execution without writing decrypted payloads to disk.

This technique evades traditional file-based defenses and has set off alarms among security teams operating in sensitive sectors.

The attack chain begins when a logon script delivered via an exposed SMB share executes WinMail[.]exe from the user’s AppData directory.

Instead of loading the genuine .NET runtime library, the binary inadvertently loads mscorsvc[.]dll, which contains the first stage loader.

Once loaded, this DLL establishes a reverse shell by invoking cmd[.]exe and creating read/write pipes to a command-and-control (C2) server.

Lateral movement and persistence are then orchestrated through hijacked Windows services that run with elevated privileges.

Bitdefender analysts noted that the EggStreme framework is composed of multiple tightly integrated components, each responsible for a distinct phase of the operation.

The EggStremeLoader, registered as a service, reads an encrypted payload file (ielowutil[.]exe[.]mui) and extracts two more layers: a reflective loader and the core backdoor agent.

By leveraging reflective injection into trusted processes like winlogon.exe or explorer.exe, the adversary ensures continuous execution in memory.

This multi-stage approach, with each layer decrypted and injected only when needed, makes detection exceedingly difficult.

In its final form, the EggStremeAgent establishes a gRPC-based communication channel secured by mutual TLS, authenticating with certificates issued by a shared malicious certificate authority.

Once the backdoor is in memory, its 58 commands enable remote fingerprinting, file manipulation, registry operations, process injection, and sophisticated lateral movement such as RPC scans and WMIC-based remote process creation.

Infection Mechanism and DLL Sideloading

EggStreme’s initial infection leverages a subtle but powerful code snippet to hijack the search order for Windows libraries.

By placing a malicious DLL alongside WinMail.exe, the malware forces the legitimate binary to load attacker-controlled code. A representative snippet is shown below:-

// Pseudo-code illustrating DLL sideloading
HANDLE hModule = LoadLibraryA("mscorsvc[.]dll");
if (hModule) {
    FARPROC pFunc = GetProcAddress(hModule, "CorBindToRuntime");
    if (pFunc) {
        pFunc();
    }
}

When WinMail.exe calls LoadLibraryA("mscorsvc[.]dll"), the Windows loader searches the local directory first, finding the malicious DLL instead of the system version.

The loader decrypts its payload using an RC4 key ("Cookies"), checks for an on-disk configuration at %APPDATA%\Microsoft\Windows\Cookies\Cookies[.]dat, and updates its in-memory C2 list accordingly.

The initial handshake comprises a 32-byte RC4-encrypted key exchange, ensuring integrity before the shell is created.

Persistence is achieved through two complementary approaches. In some instances, the attackers alter the ServiceDLL registry value under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Parameters to point to a malicious DLL.

In others, they replace service binaries and grant SeDebugPrivilege, allowing the malicious payload to run under the context of a trusted Windows service.

Both methods ensure that EggStreme components are reloaded on every reboot, maintaining a resilient foothold.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New EggStreme Malware With Fileless Capabilities Leverages DLL Sideloading to Execute Payloads appeared first on Cyber Security News.

In early May 2025, cybersecurity researchers began tracking a novel Remote Access Trojan (RAT) targeting Chinese-speaking users via phishing sites hosted on GitHub Pages.

Masked as legitimate installers for popular applications, the initial ZIP archives contained malicious executables engineered to bypass sandbox and virtual machine defenses.

Once executed, the first-stage shellcode performs time stability analysis using QueryPerformanceCounter and examines hardware configurations—disk space and CPU cores—to identify analysis environments and terminate if suspicions arise.

This meticulous evasion strategy ensures that kkRAT rarely triggers alerts during automated detonation.

Over the next stages, kkRAT deploys advanced anti-analysis techniques, dynamically resolving Windows API functions through single-byte XOR obfuscation and decrypting subsequent shellcodes with simple XOR transforms.

In the second stage, the malware unloads and disables network adapters to sever AV/EDR communications, enumerates processes associated with Chinese security vendors, and employs a vulnerable driver (RTCore64.sys) to remove registered callbacks from kernel-mode defenses.

Zscaler analysts noted that kkRAT even alters registry values for 360 Total Security to disable network checks and schedules tasks under SYSTEM privileges to repeatedly kill protection processes upon user logon.

By the third stage, kkRAT retrieves a heavily obfuscated shellcode named 2025.bin from hardcoded URLs, decodes Base64-encoded instructions in output.log, and selects download URLs based on the victim process’s filename.

The extracted archives contain legitimate executables sideloaded with malicious DLLs that decrypt the final payload—kkRAT itself—using a six-byte XOR key at offset 0xD3000.

Zscaler researchers identified this seamless use of sideloading to deploy multiple RAT variants, including ValleyRAT and FatalRAT, but the newly discovered kkRAT blended features from both Ghost RAT and Big Bad Wolf.

In its operation, kkRAT establishes a TCP connection to its command-and-control server, compresses data via zlib, and applies an additional XOR-based encryption layer.

A sample Python snippet used to decrypt captured traffic demonstrates this two-phase process:-

import zlib
def decrypt_packet(data, key):
    compressed = bytes(b ^ key for b in data)
    return zlib.decompress(compressed)

Infection Mechanism

Upon execution of the sideloaded DLL, kkRAT reads its encrypted configuration—C2 IP, port, version, and group identifier—and constructs a REGISTRATIONINFO struct containing detailed device fingerprints such as OS version, CPU frequency, memory size, installed antivirus signatures, and the presence of messaging applications.

This thorough profile allows attackers to prioritize high-value targets. Uniquely, kkRAT inspects the clipboard for cryptocurrency wallet addresses (Bitcoin, Ethereum, Tether) and replaces them with attacker-controlled addresses via the 0x4D command, a tactic designed to hijack transactions silently.

Once persistence is established through startup folder shortcuts or registry run keys, kkRAT remains resident, awaiting further instructions to load plugins—ranging from remote desktop management to process termination—and relay network traffic through Go-based SOCKS5 proxies.

Through its layered encryption, sophisticated anti-analysis checks, and financial theft capabilities, kkRAT represents a significant evolution in commodity RAT toolkits, underscoring the persistent threat of supply-chain style malware delivery.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post kkRAT Employs Network Communication Protocol to Steal Clipboard Contents appeared first on Cyber Security News.