MerlinMalware
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.From MISP Galaxy
Last reported 16 days ago, by SecurityWeek3 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1001Data Obfuscation
“…ommand and Control: Encrypted Channel: Asymmetric CryptographyThe threat actor used the GitHub API for C2, which communicates over HTTPS.T1001.003Exfiltration: Exfiltration Over Web Service: Exfiltration to Code RepositoryThe threat actor used the GitHub API to exfiltrate files t…”
- T1027Obfuscated Files or Information
“… SumatraPDF loader downloaded a second-stage shellcode from the C2 IP 58.247.193.100 which reflectively loads the AdaptixC2 Beacon agent.T1027.007Defense Evasion: Obfuscated Files or Information: Dynamic API ResolutionThe initial loader identified Windows APIs by comparing Adler-…”
- T1036Masquerading
“…uled TaskThe threat actor created a scheduled task using schtasks /create to execute the AdaptixC2 agent every two hours for persistence.T1036.001Defense Evasion: Masquerading: Invalid Code SignatureThe threat actor used a trojanized SumatraPDF executable that includes the origin…”
- T1053Scheduled Task/Job
“…ommand Shell to run several commands for reconnaissance purposes (e.g., arp, net view, tasklist) and to use cURL for downloading VS Code.T1053.005Persistence: Scheduled Task/Job: Scheduled TaskThe threat actor created a scheduled task using schtasks /create to execute the Adaptix…”
- T1053.005Scheduled Task
“…tasklist) and to use cURL for downloading VS Code.T1053.005Persistence: Scheduled Task/Job: Scheduled TaskThe threat actor created a scheduled task using schtasks /create to execute the AdaptixC2 agent every two hours for persistence.T1036.001Defense Evasion: Masquerading: Invali…”
- T1059Command and Scripting Interpreter
“Additionally, it employed the ShellExecuteW API to launch a decoy PDF document.T1059.003Execution: Command and Scripting Interpreter: Windows Command ShellThe threat actor utilized the Windows Command Shell to run several commands for reconnaissance purposes (e.g., arp, net view,…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Security Awareness Training Isn’t Dead, but It Needs a Rethink“Robert Costello, chief digital and information officer at Merlin Group, has similar concerns.”
-
Agentic security is the billion-dollar challenge for some clever startup to solve“…pable agents are finding creative and sometimes unexpected ways to accomplish their objectives,” Matt Hartman, chief strategy officer at Merlin Group, told The Register.”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“This marks a departure from earlier TOSHIS versions, which delivered either a Cobalt Strike Beacon or a Merlin Mythic agentANALYST NOTE: The AES key is derived by using the Windows API function CryptDeriveKey with the MD5 hash of a hard-coded key seed "424986c3a4fddcb6".”
Indicators in its reports
named in the reports above- ip[.]mein 1 report
- bashupload[.]appin 1 report
- below[.]postin 1 report
- confidence[.]inin 1 report
- 58.247.193[.]100in 1 report
- hxxp://bashupload[.]app/6e1lhccurlin 1 report
- hxxp://bashupload[.]app/zgel2a.binin 1 report
- 158.247.193[.]100in 1 report
- tunnel[.]postin 1 report
- tunnel[.]hostingin 1 report
- loader[.]inin 1 report
- 47.76.236[.]58in 1 report
- stg.lsmartv[.]comin 1 report
- hxxps://code.visualstudio[.]com/sha/download?build=stable&os=cli-win32-x64in 1 report
- doxx[.]netin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.