Search: “Sliver”

11 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 43 Ransomware 39 Vulnerability 35 Exploit / PoC 30 Threat actor 11 Data breach 6 Phishing & fraud 5 Industry 4 Policy & legal 4 Research 3 Advisory 2 AI safety & security 2 Tools 1 AI industry 1

SeverityAll critical 82 high 78 medium 15 low 9 info 2

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security NewsSep 8, 12:10 UTC · 8d agoThreat actor in the wild

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

The Hacker NewsJan 24, 03:37 UTC · Jan 24, 2023Threat actor

PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network

The Hacker NewsJun 6, 13:15 UTC · Jun 6, 2026Threat actor

Warning: Over 2,000 Palo Alto Networks Devices Hacked in Ongoing Attack Campaign

The Hacker NewsNov 23, 06:38 UTC · Nov 23, 2024Threat actor in the wildCVE-2024-0012 CVE-2024-9474

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.