Threats Tagged 'process-injection'

Splinter is a newly discovered post-exploitation red team tool developed in Rust, identified through memory scanning on customer systems. It is a large tool (~7MB) using statically linked libraries and operates via a JSON configuration containing implant ID, C2 server details, and operational parameters. Splinter supports a task-based model with capabilities such as Windows command execution, remote process injection, file upload/download, cloud service information gathering, and self-deletion. Communication with its command and control server occurs over HTTPS with specific URL paths for task synchronization, heartbeat, and file transfers. Although less sophisticated than Cobalt Strike, Splinter exemplifies the expanding variety of penetration testing tools that could be misused by threat actors.