Malicious tools strive to blend into ordinary network traffic, but the new Miraak framework has gone further and transformed a cloud PostgreSQL database into a full-fledged channel for controlling infected computers. Blackpoint Cyber specialists uncovered the previously unknown toolset after the attackers themselves slipped up and left part of their infrastructure exposed on the internet. A Full Post-Exploitation Arsenal Miraak is designed to operate after an initial breach of a system, and it furnishes the operator with a broad array of capabilities.

Researchers uncovered HollowFrame, a Go-based loader framework, and Matryoshka, a Rust-based malware family used in a multi-stage intrusion against two endpoints at a law firm. The attack used spear-phishing, DLL side-loading, and GitHub-based command-and-control to enable persistence, reconnaissance, file transfer, and follow-on payload delivery. #HollowFrame #Matryoshka #GitHub #BlackpointCyber...