Loading video...

Video Failed to Load

Go Home

THREAT INTELLIGENCE ALERT Forensic analysis of a commercial Malware-as-a-Service (MaaS) full package AURA C2 + AURA CRYPTER FUD v4.0 + BINDER PDF. Key findings: • Active C2 panel showing 101 clients (24 online), 39.5 GB of exfiltrated data, 102,915 passwords, and stealer_data uploads from multiple countries (Algeria, Vietnam, Singapore,...

akaclandestine's profile picture

Clandestine

63,211 subscribers

12,019 views • 21 days ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Dear threat hunters and malware analysts, Threat.Zone | Holistic Malware Analysis Platform , a Holistic Malware Analysis Platform, allows you to capture the Telegram C2 network requests of the XWORM malware and hunt the logs using Matkap! ➡️
0:55

Dear threat hunters and malware analysts, Threat.Zone | Holistic Malware Analysis Platform , a Holistic Malware Analysis Platform, allows you to capture the Telegram C2 network requests of the XWORM malware and hunt the logs using Matkap! ➡️

0x6rss

22,313 views • 1 year ago

‼️ A threat actor is allegedly selling a PDF Exploit Builder advertised as 100% FUD with unlimited builds on a popular cybercrime forum, with tiered licenses starting at $300. ⠀ ‣ Threat Actor: TheStrain ‣ Category: Illicit Service / Malware Builder ‣ Victim: Adobe Acrobat Reader, Foxit Reader (delivery vector) ‣ Industry: Malware / Exploit Tooling ⠀ The actor pitches the builder as reliable, effective, FUD, and stable, capable of bundling EXE and JAR payloads inside weaponized PDF files. They claim it supports all versions of Adobe Acrobat Reader and Foxit Reader and bypasses all forms of security. ⠀ What's offered: ⠀ ▪️ Unlimited builds ▪️ EXE and JAR payload support ▪️ Compatibility with all versions of Adobe Acrobat Reader and Foxit Reader ▪️ Claimed bypass of all forms of security ▪️ 100% FUD claim ⠀ Pricing: ⠀ ▪️ 1 Month License: $300 ▪️ 3 Months License: $500 ▪️ Lifetime License: $1,500
6:23

‼️ A threat actor is allegedly selling a PDF Exploit Builder advertised as 100% FUD with unlimited builds on a popular cybercrime forum, with tiered licenses starting at $300. ⠀ ‣ Threat Actor: TheStrain ‣ Category: Illicit Service / Malware Builder ‣ Victim: Adobe Acrobat Reader, Foxit Reader (delivery vector) ‣ Industry: Malware / Exploit Tooling ⠀ The actor pitches the builder as reliable, effective, FUD, and stable, capable of bundling EXE and JAR payloads inside weaponized PDF files. They claim it supports all versions of Adobe Acrobat Reader and Foxit Reader and bypasses all forms of security. ⠀ What's offered: ⠀ ▪️ Unlimited builds ▪️ EXE and JAR payload support ▪️ Compatibility with all versions of Adobe Acrobat Reader and Foxit Reader ▪️ Claimed bypass of all forms of security ▪️ 100% FUD claim ⠀ Pricing: ⠀ ▪️ 1 Month License: $300 ▪️ 3 Months License: $500 ▪️ Lifetime License: $1,500

Dark Web Informer

47,108 views • 3 months ago

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.
1:58

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.

Dark Web Informer

25,017 views • 4 months ago

hi threat hunters and malware analysts! I’ve shared my new C2 hunting, reporting, and visualization tool, "Keklick," on github! It helps you discover and manage potential domains/IPs related to C2 infrastructure. Happy hunting! keklick:
1:35

hi threat hunters and malware analysts! I’ve shared my new C2 hunting, reporting, and visualization tool, "Keklick," on github! It helps you discover and manage potential domains/IPs related to C2 infrastructure. Happy hunting! keklick:

0x6rss

20,611 views • 1 year ago

‼️A threat actor is advertising "Atroposia RAT," an advanced Remote Access Trojan built in C++/Rust with multifunctional capabilities, showing 9,995 clients online. Features include HVNC (Hidden VNC), stealer, vulnerability scanner, grabber, file manager, HRDP (Hidden RDP), mass execute, DNS hijack, clipboard manager, credential recovery from Chromium and Gecko browsers, crypto wallet theft, UAC bypass, and anti-CIS execution blocking (blocks in Russia, Ukraine, Belarus, Kazakhstan, etc.). The RAT offers encrypted communication, unique stubs, native executables, mutation options, persistence mechanisms, and a full C2 console with modular architecture. Pricing: $200/month | $500/3 months | $900/6 months | $1,500/year | $3,200/lifetime.
2:58

‼️A threat actor is advertising "Atroposia RAT," an advanced Remote Access Trojan built in C++/Rust with multifunctional capabilities, showing 9,995 clients online. Features include HVNC (Hidden VNC), stealer, vulnerability scanner, grabber, file manager, HRDP (Hidden RDP), mass execute, DNS hijack, clipboard manager, credential recovery from Chromium and Gecko browsers, crypto wallet theft, UAC bypass, and anti-CIS execution blocking (blocks in Russia, Ukraine, Belarus, Kazakhstan, etc.). The RAT offers encrypted communication, unique stubs, native executables, mutation options, persistence mechanisms, and a full C2 console with modular architecture. Pricing: $200/month | $500/3 months | $900/6 months | $1,500/year | $3,200/lifetime.

Dark Web Informer

40,858 views • 5 months ago

It’s time to change for the better planet. Let’s change together. . C2 น้ำดื่มที่ใสสะอาดแบบซีทรู Brand Ambassador of C2 Water . Join me and learn more about C2 water at . #C2water #JacksonXC2water #น้ำดื่มพี่แจ็ค
0:45

It’s time to change for the better planet. Let’s change together. . C2 น้ำดื่มที่ใสสะอาดแบบซีทรู Brand Ambassador of C2 Water . Join me and learn more about C2 water at . #C2water #JacksonXC2water #น้ำดื่มพี่แจ็ค

Jackson Wang

717,448 views • 3 years ago

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸
0:59

Creating COM hijacking payloads has never been easier than with RustPack! With COM Hijacking, you can persist on a target system by 'living' in trusted user processes, such as the Chrome browser. You only need to bring one DLL. When the user opens Chrome, for example, a C2 connection is established. 🔥 Achieving stable payload execution without crashing or freezing the target system requires an understanding of what is relevant. Additionally, lots of processes may attempt to load the hijacked CLSID; you don't want to receive 43 beacons per day from the same system. Limiting execution to a defined process is important here! 🎓 What about combining that payload with environmental keying, anti-emulation, anti-sandboxing, as well as AMSI and ETW bypasses? Doing all this yourself will take time. With RustPack, however, you can create such a payload in a few seconds, and it's stable! The video demonstrates how to create a payload DLL to execute Adaptix C2 shellcode in the Chrome browser. 🛸

MSec Operations

16,004 views • 1 year ago

A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor
2:14

A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor

Clandestine

88,491 views • 4 months ago

Very intelligent #android #malware actor filming his #C2 and giving away the URL. Targeting #spain and #portugal it seems. C2: hxxps://190.211.255.218/YTFlMzViNjNiNWM3/OTI0NGRhMTFlMDNk/index.php Probably: #Octo / #Coper android banker. Germán Fernández LaurieWired Alexander Leslie James @0xToxin Ankit Anubhav Tom.K vx-underground
0:25

Very intelligent #android #malware actor filming his #C2 and giving away the URL. Targeting #spain and #portugal it seems. C2: hxxps://190.211.255.218/YTFlMzViNjNiNWM3/OTI0NGRhMTFlMDNk/index.php Probably: #Octo / #Coper android banker. Germán Fernández LaurieWired Alexander Leslie James @0xToxin Ankit Anubhav Tom.K vx-underground

Gi7w0rm

47,741 views • 3 years ago

New full episode of 'whoami' podcast. I had the opportunity to talk with 5pider , author of Havoc & Havoc Pro. I had a great time learning from one of the best c2/malware devs out there. Check it out for some awesome insights.
1:33:47

New full episode of 'whoami' podcast. I had the opportunity to talk with 5pider , author of Havoc & Havoc Pro. I had a great time learning from one of the best c2/malware devs out there. Check it out for some awesome insights.

K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵

23,748 views • 1 month ago

Tools such as from Impacket are usually flagged for lateral movement due to the pre-built service executable that is dropped on the remote system. However, some vendors also flag Impacket based on its behaviour. With RustPack, you can easily create service executables that won't be detected by signatures or behaviour-based detection. 😎 In this demo video, an unsigned service executable is generated. This will only fire the payload on a system with the hostname 'Win11' — environmental keying will prevent the payload from showing up in a sandbox or cloud analysis. To avoid Impacket detection, we drop and execute the binary via the recently released Titanis protocol library from TrustedSec: The result is an Adaptix C2 connection in the SYSTEM context. 🫡 #Pentest #RedTeam #Malware #OST
0:38

Tools such as from Impacket are usually flagged for lateral movement due to the pre-built service executable that is dropped on the remote system. However, some vendors also flag Impacket based on its behaviour. With RustPack, you can easily create service executables that won't be detected by signatures or behaviour-based detection. 😎 In this demo video, an unsigned service executable is generated. This will only fire the payload on a system with the hostname 'Win11' — environmental keying will prevent the payload from showing up in a sandbox or cloud analysis. To avoid Impacket detection, we drop and execute the binary via the recently released Titanis protocol library from TrustedSec: The result is an Adaptix C2 connection in the SYSTEM context. 🫡 #Pentest #RedTeam #Malware #OST

MSec Operations

70,578 views • 9 months ago

Mark Carney is using the explosion in extorsion cases in Canada as he justification for BILL C2. Bill C2 law enforcement can tap into your electronic devices and look at your communications without a search warrant. MONITURING POLICE STATE
2:07

Mark Carney is using the explosion in extorsion cases in Canada as he justification for BILL C2. Bill C2 law enforcement can tap into your electronic devices and look at your communications without a search warrant. MONITURING POLICE STATE

Marc Nixon

171,534 views • 6 months ago

Whatever happens in Zero Hour, I hope The Sevens reveal has the same aura as this moment from The End (C2)
0:34

Whatever happens in Zero Hour, I hope The Sevens reveal has the same aura as this moment from The End (C2)

FN Posting ✨

45,673 views • 9 months ago

One of the coolest Reverse Engineering TTPs. Analyzing APT29's recurring phishing methodologies and provides practical, technical demonstration on how reverse engineers extracts and reverse engineered Commercial C2 to uncover its operational security flaws. Re by ippsec
44:16

One of the coolest Reverse Engineering TTPs. Analyzing APT29's recurring phishing methodologies and provides practical, technical demonstration on how reverse engineers extracts and reverse engineered Commercial C2 to uncover its operational security flaws. Re by ippsec

Smukx.E

26,066 views • 14 days ago

Finally jumped on this Ai Red Team train and I am blown away by the results used and MCP Server to communicate to a simple C2 channel and asked for enumeration tasks, view file content and open an application all via the C2 what amazing results! #redteam
0:53

Finally jumped on this Ai Red Team train and I am blown away by the results used and MCP Server to communicate to a simple C2 channel and asked for enumeration tasks, view file content and open an application all via the C2 what amazing results! #redteam

David

24,355 views • 1 year ago

Chinese rj45 USB adapter malware??? Our line-by-line code analysis of the "malware" and a reasonable explanation for its strange delivery (part 1)
42:41

Chinese rj45 USB adapter malware??? Our line-by-line code analysis of the "malware" and a reasonable explanation for its strange delivery (part 1)

herrcore

28,749 views • 1 year ago

Day 30/100 of Cybersecurity. Hunting a kernel level Malware. How do you detect a malware threat that hides directly in the kernel? 🕵️‍♂️ In this deep dive, I show you how to use Wazuh SIEM to hunt down a rootkit called Diamorphine and flag hidden processes that bypass standard OS checks. 👇 Special thanks to Tech Sphere Academy for being a great online institute for learning cyber skills #Cybersecurity #InfoSec #Wazuh #Malware
18:45

Day 30/100 of Cybersecurity. Hunting a kernel level Malware. How do you detect a malware threat that hides directly in the kernel? 🕵️‍♂️ In this deep dive, I show you how to use Wazuh SIEM to hunt down a rootkit called Diamorphine and flag hidden processes that bypass standard OS checks. 👇 Special thanks to Tech Sphere Academy for being a great online institute for learning cyber skills #Cybersecurity #InfoSec #Wazuh #Malware

SOMA

35,716 views • 1 month ago

DEF CON 33 - Turning your Active Directory into the attackers C2. TL;DR: GPOs can turn Active Directory into a powerful C2 primitive. This talk dives into GPO internals, enumeration, persistence, privilege escalation, and advanced exploitation techniques.
43:04

DEF CON 33 - Turning your Active Directory into the attackers C2. TL;DR: GPOs can turn Active Directory into a powerful C2 primitive. This talk dives into GPO internals, enumeration, persistence, privilege escalation, and advanced exploitation techniques.

Smukx.E

33,605 views • 12 days ago