𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲

Creators of #NetworkMiner, #CapLoader, #PolarProxy, #FlowCarp and #RawCap.

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Netresec is @[email protected] on Mastodon:
https://t.co/gjSSLHGUFR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

@abuse_ch Sorry for the cross post. It's AzaleaControl C2.
https://t.co/SGd2UBdwL4

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

https://t.co/8x9BHx2guQ
https://t.co/2rN1Y5ziC4

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Is this a new ValleyRAT variant from SilverFox (银狐) or a completely new malware?
Custom protocol over TCP 443. C2 traffic starts with:
"BFuck" (42 46 75 63 6b 00 00 00)

IOCs:
👾 38.76.177.46:443
👾 43.99.101.175:443
https://t.co/tgPnjik7XG

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

@Jane_0sint Looks like LAC did a follow-up analysis on the same RAT
https://t.co/mHK3d0AEq7

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

@wessorh Wow, that's an interesting solution!

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Maximizing IOC Impact: Advice on extracting, verifying, and sharing IOCs for fast, broad protection.
https://t.co/aIylJK4REY

[Huntress @HuntressLabs]

The whole chain barely touches disk.

HTML → JScript → PowerShell → .NET loader → RAT, nearly all in memory.

Full writeup and IOCs from @RussianPanda9xx and Adam Mooney.

https://t.co/7OaPrMdDUR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

@HuntressLabs @RussianPanda9xx You can get a verdict on the protocol from FlowCarp by submitting a PCAP like this:
curl --data-binary @​desckvb-rat.​pcap https:​//demo.flowcarp.​com

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

@HuntressLabs @RussianPanda9xx CapLoader and FlowCarp both identify the traffic to 48.202.58.22:7211 as "BlueLoader", which is a new RAT from PureCoder. The description of "DesckVB RAT" in your blog post also seem to match what we know about BlueLoader. Can you please verify if it is the same thing?

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

PolarProxy 2.0.1 Released 🐻‍❄️
💨 Improved performance
🐞 Bug fixes
⚖️ Prioritizes PCAP output over throughput
https://t.co/pSn07p2gIW

[Scan Malware @scanmalware]

It's now possible to do ScanMalware lookups from @netresec CapLoader:

https://t.co/je31cWOtKv

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New release of CapLoader
🫆 JA3/JA4/SNI extraction from multi-segment TLS handshakes
🚨 Alerts on IOCs from @viql's Rösti
👀 OSINT lookup on @jonasl's ScanMalware
📦️Extracts packets from more encapsulation protocols
https://t.co/bbKCa8yutE

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

PolarProxy 2.0 TLS inspection proxy released
📦️Single self-contained binary release
🔀 Improved HTTP proxy
🐳 Builds for Linux musl (Alpine) ARM/ARM64
🪄 Simplified deployment
🔪 Flow cutoff in output PCAP
https://t.co/7sXiudBebT

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Viewing #remcos alerts from FlowCarp in @jasonish's #EveBox
https://t.co/DUVUWFnAom

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New tool released: #FlowCarp
🔍️Identifies protocols without port numbers
🔨 Build protocol detection from example traffic
➡️ Input: PCAP or PcapNG
⬅️ Output: Flows and/or Alerts
https://t.co/3sqnfOpN4a

[DFRWS @DFRWS]

✨ DFRWS EU 2026 Workshops

Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations.

📍 Workshop Dates 23–24 March 2026
🧿 Details here: https://t.co/Aitqb7i2ua

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

21 of the world's best intelligence and security agencies cannot be wrong... right?
https://t.co/eALNc5OHtF

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Do CISA analysts type out IOC domains by hand?
https://t.co/VpI6LUhlKR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Netresec is @netresec.com on Bluesky:
https://t.co/wDktzNKJhR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Netresec is @[email protected] on Mastodon:
https://t.co/gjSSLHGUFR