Getting third party C2 channels to work effortlessly with any implant.

less than 1 minute read

Coming Soon! C3 is great but takes too much work to get a new C2 framework to work with it, and hasn’t been fully updated. The included covenant connector doesn’t even work anymore. I am improving C3 to also work using a http proxy for the client interface and a custom server http piece that emulates client connections for the server interface. Nearly all C2 frameworks support http proxy and http reverse connections.

Twitter Facebook LinkedIn

Probing VirusTotal sandboxes for custom detection markers.

5 minute read

If you ever uploaded a live implant to VirusTotal you will notice many callbacks from sandboxes. A common defense faced by attackers is the use of EDRs that ...

Hello World!

less than 1 minute read

I have migrated my blog from Keystone.js to Jekyll. I have also switched from self hosting to using GitHub pages.

Spear Phishing with Word Macro and Decoy Document

5 minute read

Microsoft Word macros are often utilized in spear phishing attacks. These documents typically include a lure to trick the user into clicking “Enable Content....

Stealthy and Efficient Data Exfiltration using Google Drive

8 minute read

Data exfiltration is a continual process during the post-exploitation stage. After initial entry, the attacker targets the domain admins. The attackers often...

Kevin Wang

Getting third party C2 channels to work effortlessly with any implant.

You May Also Enjoy

Probing VirusTotal sandboxes for custom detection markers.

Hello World!

Spear Phishing with Word Macro and Decoy Document

Stealthy and Efficient Data Exfiltration using Google Drive