Attributed metadata history
Up to 100 retained publisher events per page for 29234ab4b62abae12bd1aaf319afed707c4e252ce751827360569e81dfe0fb25. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_c25d91fa3ad9ae9ac7
observed · 2026-10-12 14:53:03 UTC
available
Fingerprint: 0a2f1bebc7ea800736eafab237a0ddecfb8797a02d23951e8aa80935e2f3446f
intelligence_src_c25d91fa3ad9ae9ac7
observed · 2026-10-12 14:53:03 UTC
The other day Microsoft published a great deep dive around the second stage payloads and hands-on hacking activities of the Solarwinds/Sunburst incidents that where uncovered late 2020. One thing that is so interesting is the use of off the shelve Cobalt Strike tooling and templates for command & control. After doing all the hard work and customization to seamlessly backdoor binaries the adversaries sem to use Cobalt Strike. Intel for Red Teamers Although, they did add customizations with some interesting features, which are interesting for red teamers to be aware of. For instance each instance of the zombie would be unique in name, folder locations, etc. to make it more difficult to identify in environments.
Fingerprint: 8a32b77bdaae2055950493ed16f44913fc41aed774fba6e2a7055669f68d83b9