Threats Tagged 'https tunneling'
View all threats tagged with 'https tunneling'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'https tunneling'
Click on any threat for detailed analysis and mitigation recommendations
Suo5 is an HTTP/HTTPS-based tunneling tool exploited for pivoting attacks via compromised web servers to access internal networks. It supports multiple environments including Java, PHP, IIS/.NET, and Nginx, and relays TCP traffic enabling SOCKS5 proxy access. Deployment methods include file upload exploitation on IIS servers using renamed ASPX files and memory injection via Jenkins Script Console with Groovy scripts. Indicators of compromise include repeated POST requests in web logs, DLL files in Temporary ASP.NET Files directories, and PluginServletFilter chains in Java logs. Detection involves monitoring web request patterns, server-side behaviors, abnormal User-Agent headers, unauthorized URI access, and file modifications. Mitigations include restricting script execution capabilities and implementing network segmentation controls. Join the discussion | AlienVault OTX General | 10/16/2026, 07:33:13 UTC Added: 10/19/2026, 09:33:39 UTC |
Showing 1 to 1 of 1 result