TeamItaly Cyberdefender European cybersecurity champions: discover how young Italians are defending digital Europe.

Scenario An alert from the Intrusion Detection System (IDS) flagged suspicious lateral movement activity involving PsExec. This indicates potential unauthorized access and movement across the network. As a SOC Analyst, your task is to investigate the provided PCAP file to trace the attacker’s activities. Identify their entry point, the machines targeted, the extent of the breach, and any critical indicators that reveal their tactics and objectives within the compromised environment. Category: Network Forensics Tactics Execution, Defense Evasion, Discovery, Lateral Movement Tools: Wireshark PsExec Hunt | Blue team challenge. Questions Q1: To effectively trace the attacker’s activities within our network, can you identify the IP address of the machine from which the attacker initially gained access? Q2: To fully understand the extent of the breach, can you determine the machine’s hostname to which the attacker first pivoted? With the attacker’s IP locked in, we zeroed in on SMB traffic to 10.0.0.133: ip.addr == 10.0.0.130 && ip.addr == 10.0.0.133 We spotted a critical packet: 131 2023/284 00:42:08.878607443 10.0.0.133 → 10.0.0.130 SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE Following the TCP stream, we scrolled through the NTLMSSP payload and struck gold: Workstation: SALES-PC. This confirmed SALES-PC as the first machine the attacker compromised after gaining access. Answer: The first pivoted machine’s hostname is SALES-PC. Q3: Knowing the username of the account the attacker used for authentication will give us insights into the extent of the breach. What is the username utilized by the attacker for authentication? Sticking with the SMB traffic, we filtered for NTLMSSP authentication: ip.addr == 10.0.0.130 Packet 132 revealed the smoking gun: 132 2023/284 00:42:08.879115750 10.0.0.130 → 10.0.0.133 SMB2 Session Setup Request, NTLMSSP_AUTH, User: \ssales The attacker authenticated as ssales, likely using stolen credentials or a pass-the-hash technique to gain a foothold on SALES-PC. Answer: The username used is ssales. Q4: After figuring out how the attacker moved within our network, we need to know what they did on the target machine. What’s the name of the service executable the attacker set up on the target? PsExec is notorious for dropping a service executable to run commands remotely. We filtered for SMB Create/Write requests: smb2 && (smb2.cmd == 5 || smb2.cmd == 9) Boom! Packet 144 showed: 144 2023/284 00:42:08.885179064 10.0.0.130 → 10.0.0.133 SMB2 Create Request File: PSEXESVC.exe This confirmed PsExec’s hallmark: deploying PSEXESVC.exe to execute malicious commands on the target. Answer: The service executable is PSEXESVC.exe Q5: We need to know how the attacker installed the service on the compromised machine to understand the attacker’s lateral movement tactics. This can help identify other affected systems. Which network share was used by PsExec to install the service on the target machine? PsExec typically uses administrative shares to drop its executable. We revisited the Create Request from Question 4: smb2 && frame contains "PSEXESVC" \\10.0.0.133\ADMIN$\PSEXESVC.exe The ADMIN$ share, a hidden Windows share for administrative access, was used to upload PSEXESVC.exe to SALES-PC. Answer: The network share used is ADMIN$ Q6: We must identify the network share used to communicate between the two machines. Which network share did PsExec use for communication? PsExec relies on named pipes for command and control. We filtered for SMB Tree Connect or Create requests: smb2 && (smb2.cmd == 3 || smb2.cmd == 5) The TCP stream revealed connections to: \\10.0.0.133\IPC$ The IPC$ (Inter-Process Communication) share is PsExec’s go-to for facilitating remote procedure calls and service control via named pipes like \\PIPE\\svcctl. Answer: The network share for communication is IPC$ Q7:Now that we have a clearer picture of the attacker’s activities on the compromised machine, it’s important to identify any further lateral movement. What is the hostname of the second machine the attacker targeted to pivot within our network? To catch further lateral movement, we filtered for traffic from the attacker’s IP (10.0.0.130) to other hosts: 19 2023/284 00:37:58.580105328 10.0.0.131 → 224.0.0.252 LLMNR 72 Standard query 0x611b ANY Marketing-PC This LLMNR query for Marketing-PC suggests the attacker was enumerating or targeting this host. Although the source IP (10.0.0.131) differs, it likely indicates a typo or a secondary compromised system, with 10.0.0.130 as the primary attacker IP. We confirmed no SMB traffic to 10.0.0.131, but the LLMNR query points to Marketing-PC as the next pivot target. Answer: The second targeted hostname is Marketing-PC 🎉 Mission Accomplished! We’ve traced the attacker’s every move with forensic precision. CyberDefender: “PsExec Hunt Lab” Challenge Writeup was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

A spate of recent typosquatting attacks show the scourge of this type of attack is still very much with us, even after decades of cyberdefender experience with it.

CyberChallenge.IT è il primo programma italiano di formazione introduttiva in cybersecurity per studenti delle scuole superiori e universitari.

 Cybersecurity analysts have uncovered a new malware campaign that relies on cracked software download platforms to distribute an updated variant of a stealthy and modular loader known as CountLoader. According to researchers from the Cyderes Howler Cell Threat Intelligence team, the operation uses CountLoader as the entry point in a layered attack designed to establish access, evade defenses, and deploy additional malicious payloads.  CountLoader has been observed in real-world attacks since at least June 2025 and was previously analyzed by Fortinet and Silent Push. Earlier investigations documented its role in delivering widely used malicious tools such as Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and cryptomining malware. The latest iteration demonstrates further refinement, with attackers leveraging familiar piracy tactics to lure victims.  The infection process begins when users attempt to download unauthorized copies of legitimate software, including productivity applications. Victims are redirected to file-hosting platforms where they retrieve a compressed archive containing a password-protected file and a document that supplies the password. Once extracted, the archive reveals a renamed but legitimate Python interpreter configured to run malicious commands. This component uses the Windows utility mshta.exe to fetch the latest version of CountLoader from a remote server.   To maintain long-term access, the malware establishes persistence through a scheduled task designed to resemble a legitimate Google system process. This task is set to execute every 30 minutes over an extended period and relies on mshta.exe to communicate with fallback domains. CountLoader also checks for the presence of endpoint protection software, specifically CrowdStrike Falcon, adjusting its execution method to reduce the risk of detection if security tools are identified.  Once active, CountLoader profiles the infected system and retrieves follow-on payloads. The newest version introduces additional capabilities, including spreading through removable USB drives and executing malicious code entirely in memory using mshta.exe or PowerShell. These enhancements allow attackers to minimize their on-disk footprint while increasing lateral movement opportunities. In incidents examined by Cyderes, the final payload delivered was ACR Stealer, a data-harvesting malware designed to extract sensitive information from compromised machines.  Researchers noted that the campaign reflects a broader shift toward fileless execution and the abuse of trusted, signed binaries. This approach complicates detection and underscores the need for layered defenses and proactive threat monitoring as malware loaders continue to evolve.   Alongside this activity, Check Point researchers revealed details of another emerging loader named GachiLoader, a heavily obfuscated JavaScript-based malware written in Node.js. This threat is distributed through the so-called YouTube Ghost Network, which consists of hijacked YouTube accounts used to promote malicious downloads. The campaign has been linked to dozens of compromised accounts and hundreds of thousands of video views before takedowns occurred.  In some cases, GachiLoader has been used to deploy second-stage malware through advanced techniques involving Portable Executable injection and Vectored Exception Handling. The loader performs multiple anti-analysis checks, attempts to gain elevated privileges, and disables key Microsoft Defender components to avoid detection. Security experts say the sophistication displayed in these campaigns highlights the growing technical expertise of threat actors and reinforces the importance of continuously adapting defensive strategies.

  Today’s cyber threat landscape is rapidly evolving, making it increasingly difficult for adversaries to tell the difference between traditional malware families, as adversaries combine their capabilities to maximise their impact. Skitnet, an advanced multistage post-exploitation toolkit, is one of the best examples of this convergence, as it emerged as an evolution of the legacy Skimer malware, a sophisticated multi-stage post-exploitation toolkit.  Skitnet, which was once used as a tool for skimming card information from ATMs, has been repurposed as one of the strongest weapons in the arsenal of advanced ransomware groups, notably Black Basta. In the last few months, it has appeared again as part of a larger tactical shift aimed at focusing on stealth, persistent access, data exfiltration, and support for double extortion ransomware campaigns that move away from singular objectives like financial theft.  Since April 2024, Skitnet, which is also known as Bossnet in some underground circles, has been actively traded on darknet forums like RAMP, with a noticeable uptake noticed among cybercriminals by early 2025. This version has an enterprise-scale modular architecture, unlike its predecessor, which allows it to operate at an enterprise scale.  There is no need to worry about fileless execution, DNS-based communication for command-and-control (C2), system persistence, or seamless integration with legitimate remote management tools like PowerShell or AnyDesk to use it. Through this flexibility, attackers can continue to remain covert inside targeted environments for extended periods of time without being noticed.  In addition to being a threat to enterprises, Skitnet has also been deployed through sophisticated phishing campaigns that attempt to duplicate trusted enterprise platforms such as Microsoft Teams, thus allowing threat actors to use social engineering as a primary vector for gaining access to networks and systems.  Moreover, this evolution demonstrates the growing commoditization of post-exploitation toolkits on underground markets, which offers a leading indicator of how ransomware groups are utilising increasingly advanced malware to refine their tactics and enhance the overall efficiency of their operations.  According to recent threat intelligence findings, multiple ransomware groups are now actively integrating Skitnet into their post-exploitation toolkits in order to facilitate data theft, maintain persistent remote access to compromised enterprise systems, and reinforce control over compromised enterprise systems as well as facilitate after-exploitation data theft. Skitnet began circulating in underground forums like RAMP as early as April 2024, but its popularity skyrocketed by early 2025, when several prominent ransomware actors began leveraging its use in active campaigns to target consumers. Several experts believe that Skitnet will end up being a major ransomware threat to the public shortly. The ransomware group Black Basta, for instance, was seen using Skitnet as part of phishing campaigns mimicking Microsoft Teams communications in April of 2025, an increasingly common technique that exploits the trust of employees towards workplace collaboration tools.  The Skitnet campaign targets enterprise environments, where its stealth capabilities and modular design make it possible for the attacker to deep infiltrate and stay active for a long time. PRODAFT is tracking Skitnet as LARVA-306, the threat actor designated by the organisation. Skitnet, also known in underground circles by Bossnet, is a multi-stage malware platform designed to be versatile and evasive in nature.  A unique feature of this malware is its use of Rust and Nim, two emerging programming languages in the malware development community, to craft payloads that are highly resistant to detection. By initiating a reverse shell via the DNS, the malware bypasses traditional security monitoring and allows attackers to remain in communication with the command-and-control infrastructure and maintain covert communications.  Further increasing Skitnet's threat potential are its robust persistence mechanisms, the ability to integrate with legitimate remote access tools, and the ability to exfiltrate data built into its software. The .NET loader binary can also be retrieved and executed by the server, which serves as a mechanism to deliver additional payloads to the machine, thus increasing its operational flexibility.  As described on dark web forums, Skitnet is a “compact package” comprised of a server component as well as a malware payload that is easy to deploy. As a result of Skitnet's technical sophistication and ease of deployment, it continues to be a popular choice among cybercriminals looking for scalable, stealthy, and effective post-exploitation tools.  There is a modular architecture built into Skitnet, with a PowerShell-based dropper that decodes and executes the core loader in a centralised manner. Using HTTP POST requests with AES-encrypted payloads, the loader retrieves task-specific plugins from hardcoded command-and-control servers that are hardcoded. One of its components is skitnel.dll, which makes it possible to execute in memory while maintaining the persistence of the system through built-in mechanisms. Researchers have stated that Skitnet's plugin ecosystem includes modules that are dedicated to the harvesting of credentials, escalation of privileges, and lateral movement of ransomware, which allow threat actors to tailor their attacks to meet the strategic objectives and targets of their attacks. It is clear from the infection chain that Skitnet is a technical advancement in the post-exploitation process, beginning with the execution of a Rust-based loader on compromised hosts.  With this loader, a Nim binary that is encrypted with ChaCha20 is decrypted and then loaded directly into memory, allowing the binary to be executed stealthily, without the need for traditional detection mechanisms. The Nim-based payload establishes a reverse shell through a DNS-based DNS request, utilising randomised DNS queries to initiate covert communications with the command-and-control (C2) infrastructure as soon as it is activated.  To carry out its core functions, the malware then launches three different threads to manage its core functions: one thread takes care of periodic heartbeat signals, another thread monitors and extracts shell output, and yet another thread monitors and decrypts responses received over DNS, and the third thread listens for incoming instructions. Based on the attacker's preferences set within the Skitnet C2 control panel, command execution and C2 communication are dynamically managed, using either HTTP or DNS protocols.  Through the web-based interface, operators can view infected endpoints in real-time, view their IP address, their location, and their system status, as well as remotely execute command-line commands with precision, in real time. As a result of Skitnet's level of control, it has become a very important tool in modern ransomware campaigns as a highly adaptable and covert post-exploitation tool.  As opposed to custom-built malware created just for specific campaigns, Skitnet is openly traded on underground forums, offering a powerful post-exploitation solution to cyber criminals of all sorts. The stealth characteristics of this product, as well as minimal detection rates and ease of deployment, make it an attractive choice for threat actors looking to maximise performance and maintain operational covertness. With this ready accessibility, the technical barrier to executing sophisticated attacks is dramatically reduced.  Real-World Deployments by Ransomware Groups There is no doubt in my mind that Skitnet is not just a theoretical concept. Security researchers have determined that it has been used in actual operations conducted by ransomware groups such as Black Basta and Cactus, as well as in other real-life situations.  As part of their phishing campaigns, actors have impersonated Microsoft Teams to gain access to enterprise environments. In these attacks, Skitnet has successfully been deployed, highlighting its growing importance among ransomware threats.  Defensive Measures Against Skitnet  Skitnet poses a significant risk to organisations. Organisations need to adopt a proactive and layered security approach to mitigate these risks. Key recommendations are as follows:  DNS Traffic Monitoring: Identify and block unusual or covert DNS queries that might be indicative of an activity like command and control.  Endpoint Detection and Response (EDR) Use advanced EDR tools to detect and investigate suspicious behaviour associated with Rust and Nim-based payloads. Often, old antivirus solutions are unable to detect these threats.  PowerShell Execution Restrictions: PowerShell should be limited to only be used in situations that prevent unauthorised script execution and minimise the risk of a fileless malware attack.  Regular Security Audits Continually assess and manage vulnerabilities to prevent malware like Skitnet from entering the network and exploiting them, as well as administer patches as needed.  The Growing Threat of Commodity Malware  In the context of ransomware operations, Skitnet represents the evolution of commodity malware into a strategic weapon. As its presence in cybercrime continues to grow, organisations are required to stay informed, agile, and ready to fight back. To defend against this rapidly evolving threat, it is crucial to develop resilience through threat intelligence, technical controls, and user awareness.  Often times, elite ransomware groups invest in creating custom post-exploitation toolsets, but they take a considerable amount of time, energy, and resources to develop them—factors that can restrict operational agility. Skitnet, on the other hand, is a cost-effective, prepackaged alternative that is not only easy to deploy but also difficult to attribute, as it is actively distributed among a wide range of threat actors.  A broad distribution of incidents further blurs attribution lines, making it more difficult to identify threat actors and respond to incidents. The cybersecurity firm Prodaft has published on GitHub associated Indicators of Compromise (IoCs) related to incident response. As a result of Skitnet's plug-and-play architecture and high-impact capabilities, it is particularly appealing to groups that wish to achieve strategic goals with minimal operational overhead in terms of performance and operational efficiency.  According to Prodaft in its analysis, Skitnet is particularly attractive for groups that are trying to maximise impact with the lowest overhead. However, in spite of the development of antivirus evasion techniques for custom-made malware, the affordability, modularity, and stealth features of Skitnet continue to drive its adoption in the marketplace.  Despite the fact that it is a high-functioning off-the-shelf tool, its popularity in the ransomware ecosystem illustrates a growing trend that often outweighs bespoke development when attempting to achieve disruptive outcomes. As ransomware tactics continue to evolve at an explosive rate, the advent and widespread adoption of versatile toolkits like Skitnet are a stark reminder of how threat actors have been continually refining their methods in order to outpace traditional security measures.  A holistic and proactive cybersecurity posture is vital for organisations to adopt to protect themselves from cyber threats and evade detection, one that extends far beyond basic perimeter defences and incorporates advanced threat detection, continuous monitoring, and rapid incident response capabilities. To detect subtle indicators of compromise that commodity malware like Skitnet exploits to maintain persistence and evade detection, organisations should prioritise integrating behavioural analytics and threat intelligence.  It is also vital to foster an awareness of cybersecurity risks among employees, particularly when it comes to the risks associated with phishing and social engineering, to close the gap in human intelligence that is often the first attack vector employed by cybercriminals. Organisations must be able to protect themselves from sophisticated post-exploitation tools through multilayered defence strategies combining technology, processes, and people, enabling them to not only detect and mitigate the current threats but also adapt to emerging cyber risks in an ever-changing digital environment with rapidity.

Scenario The SOC team has detected suspicious activity in the network traffic, revealing that a machine has been compromised. Sensitive company information has been stolen. Your task is to use Network Capture (PCAP) files and Threat Intelligence to investigate the incident and determine how the breach occurred. Category: Network Forensics Tactics: Execution, Command and Control Tools: Wireshark, VirusTotal, ANY.RUN, Network Miner Introduction In cybersecurity, every byte tells a story — a story of attack and defense, intrusion and investigation. Recently, I participated in a CTF challenge where the SOC detected a breach: sensitive company data was stolen, and it was up to me to dig through network traffic, uncover the attacker’s trail, and analyze the malicious payloads. I relied heavily on NetworkForensicsAI , my custom deep packet inspection tool, to automate and accelerate packet analysis. Let me take you through the full journey, from identifying the attacker’s IP to hashing malicious DLLs — all with explanations, code snippets, and insights. Questions Q1: Which IP address was used by the attacker during the initial access? I started by running NetworkForensicsAI’s deep packet inspection script on the suspicious PCAP file: python3 packetsensei_pro_file_save.py 205-DanaBot.pcap --save-files This command performs a deep inspection and extracts any files carried inside the traffic. Output snippet: [*] Starting Deep Packet Inspection on 205-DanaBot.pcap [+] DPI Results (Top 5): Src: 10.2.14.101:49786 -> Dst: 62.173.142.148:80 Payload: GET /login.php HTTP/1.1 Host: portfolio.serveirc.... ... [+] Saved file: extracted_files/188.114.97.3_80->10.2.14.101_49799.exe (11923100 bytes) [+] Saved file: extracted_files/10.2.14.101_49804->40.83.50.91_443.exe (40059 bytes) [+] Saved file: extracted_files/23.0.174.88_443->10.2.14.101_49576.exe (4653 bytes) [+] Total Files Found: 3 The script’s analysis pointed me directly to the external IP 62.173.142.148 as the destination of the initial HTTP request on port 80, indicating the attacker’s control. Answer: 62.173.142.148 Q2: What is the name of the malicious file used for initial access? Next, I wanted to know which file the attacker used for initial access. I used Wireshark’s Follow TCP Stream on the session between 10.2.14.101 62.173.142.148 on port 80. The HTTP response revealed: Content-disposition: attachment;filename=allegato_708.js So the malicious file delivered was named: Answer: allegato_708.js Q3: What is the SHA-256 hash of the malicious file used for initial access? Unfortunately, the PCAP did not directly contain a saved copy of this JS file. So I leveraged threat intelligence platforms for clues. I searched for allegato_708.js and the attacker IP in public sandboxes and found matching reports on Hybrid Analysis and  ANY.RUN. From ANY.RUN a detailed report, I found the SHA-256 hash of the JavaScript payload: Answer: 847B4AD90B1DABA2D9117A8E05776F3F902DDA593FB1252289538ACF476C4268 Q4: Which process was used to execute the malicious file? The sandbox behavior report showed that allegato_708.js was executed by: wscript.exe Windows Script Host’s It wscript.exe is a favorite tool for attackers to run scripts stealthily. Answer: wscript.exe Q5: What is the file extension of the second malicious file utilized by the attacker? The sandbox also showed the attacker dropped a second-stage payload: %WINDIR%\system32\advapi32.dll A DLL file — often used for side-loading and persistence. Answer: .dll Q6: What is the MD5 hash of the second malicious file? Digging deeper into the sandbox’s file system, I found a temporary DLL file dropped by the attacker: C:\Users\admin\AppData\Local\Temp\JffleeTicl.dll Its MD5 hash (from the sandbox report) was: Answer: E758E07113016ACA55D9EDA2B0FFEEBE DanaBot | Blue team challenge. Conclusion Network forensics is a thrilling blend of detective work and technical prowess. This investigation took me from a single PCAP file to a complete understanding of how an attacker infiltrated a network and deployed multi-stage malware. Thanks for coming along on the journey — I hope this walkthrough inspires your cyber hunting adventures! CyberDefender: “DanaBot Lab” Challenge Writeup was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Scenario

“Among the victims in May, students were the most affected group, with about 50 students falling victim to bogus job offers,” police said in a post on their CyberDefender Facebook page. Police have warned residents to be wary of job offers, especially…

“Among the victims in May, students were the most affected group, with about 50 students falling victim to bogus job offers,” police said in a post on their CyberDefender Facebook page. Police have warned residents to be wary of job offers, especially…

“Among the victims in May, students were the most affected group, with about 50 students falling victim to bogus job offers,” police said in a post on their CyberDefender Facebook page. Police have warned residents to be wary of job offers, especially…

‎CyberDefender isn’t just another space shooter — it’s a dopamine-charged arcade rush that grabs you from the very first shot. FEATURES • Explosive Battles – Dynamic particles, neon lasers, and vibr...

A 25-year-old Hong Kong man was scammed out of HK$4,900 (US$624) when trying to buy two tickets for Blackpink’s pair of concerts in the city next year, as police received 200 reports related to online shopping scams in the past week. The victims in those cases were cheated out of HK$5.5 million in total, according to the force’s CyberDefender anti-scam Facebook page that posted an advisory on Saturday warning residents to be vigilant when making purchases online.

A 66-year-old Hong Kong retiree lost 6.6 million Hong Kong dollars (roughly $840,000) in a string of three related crypto investment scams after repeatedly trusting self-proclaimed “virtual currency experts” who reached out via WhatsApp, according to Hong Kong police’s CyberDefender unit. In a March 20 Facebook post, police said the victim was first approached in September 2025 by a scammer who cold messaged, claiming to be a “virtual currency investment expert” and promising steady gains if the victim followed his advice. 

Leverage Sysmon log extracted from memory dump to investigate malware attack with help of threat intel report.

“Among the victims in May, students were the most affected group, with about 50 students falling victim to bogus job offers,” police said in a post on their CyberDefender Facebook page. Police have warned residents to be wary of job offers, especially…