𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲

Creators of #NetworkMiner, #CapLoader, #PolarProxy, #FlowCarp and #RawCap.

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Netresec is @[email protected] on Mastodon:
https://t.co/gjSSLHGUFR

[Scan Malware @scanmalware]

It's now possible to do ScanMalware lookups from @netresec CapLoader:

https://t.co/je31cWOtKv

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New release of CapLoader
🫆 JA3/JA4/SNI extraction from multi-segment TLS handshakes
🚨 Alerts on IOCs from @viql's Rösti
👀 OSINT lookup on @jonasl's ScanMalware
📦️Extracts packets from more encapsulation protocols
https://t.co/bbKCa8yutE

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

PolarProxy 2.0 TLS inspection proxy released
📦️Single self-contained binary release
🔀 Improved HTTP proxy
🐳 Builds for Linux musl (Alpine) ARM/ARM64
🪄 Simplified deployment
🔪 Flow cutoff in output PCAP
https://t.co/7sXiudBebT

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Viewing #remcos alerts from FlowCarp in @jasonish's #EveBox
https://t.co/DUVUWFnAom

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New tool released: #FlowCarp
🔍️Identifies protocols without port numbers
🔨 Build protocol detection from example traffic
➡️ Input: PCAP or PcapNG
⬅️ Output: Flows and/or Alerts
https://t.co/3sqnfOpN4a

[DFRWS @DFRWS]

✨ DFRWS EU 2026 Workshops

Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations.

📍 Workshop Dates 23–24 March 2026
🧿 Details here: https://t.co/Aitqb7i2ua

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

21 of the world's best intelligence and security agencies cannot be wrong... right?
https://t.co/eALNc5OHtF

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Do CISA analysts type out IOC domains by hand?
https://t.co/VpI6LUhlKR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Netresec is @netresec.com on Bluesky:
https://t.co/wDktzNKJhR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Netresec is @[email protected] on Mastodon:
https://t.co/gjSSLHGUFR

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

@greenplan_it Interesting pivot point!
Those samples behave like "normal" ValleyRAT implants though, communicating with C2 servers like
👾 137.220.153.22:8880
👾 154.82.84.217:8880
👾 206.238.40.106:8880
👾 137.220.154.46:9000

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New RAT C2 found. What malware C2 protocol is this is?
🔥 47.83.173.19:5050
🔥 47.84.203.73:5050
🔥 xuanwcai[.]com:5050
🔥 wkaiuahaaxx[.]icu:5050

Links to samples on ANY.​RUN and JoeSandbox available via infosec.​exchange link.
https://t.co/sImrWQmJ73

[DFRWS @DFRWS]

✨ DFRWS EU 2026 Workshops

Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations.

📍 Workshop Dates 23–24 March 2026
📍 Details here: 👉 https://t.co/Aitqb7i2ua

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Erik Hjelmvik will run a hands-on network forensic workshop at the upcoming Digital Forensics Research Conference in Sweden. Participants will get the chance to analyze:
🔪 Packets carved from memory dumps
🧅 Unencrypted Tor traffic
https://t.co/N5CD2wuSnY

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Decoding njRAT C2 traffic to extract screenshots, commands and transferred files
https://t.co/NYSJ7thBFe

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Check out our network forensics class if you'd like to spend more time analyzing malware PCAP files.
https://t.co/RriqjVOQ4q

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Decoding malware C2 with CyberChef
https://t.co/rVHUzhUFNm

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

Thank you for those kind words! 💜
https://t.co/uh2xI85YGU

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

The early bird discount for our network forensics class expires by the end of this week. Sign up if you’d like to analyze PCAP files together with Erik Hjelmvik (creator of NetworkMiner and PolarProxy).
https://t.co/RriqjVOQ4q

[DFRWS @DFRWS]

DFRWS EU 2026 is seeking posters showcasing interesting digital forensics research for presentation in Linköping, Sweden, 24–27th March 2026. 📥 Submit via EasyChair ( as PDF) - Rolling notification until the program is full! #DFRWSEU2026 #DFRWS #DigitalForensics