SliverMalware
According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server.From MISP Galaxy
Last reported 28 days ago, by SOCRadar17 reports
ATT&CK techniques
6 of 116 · each with the sentence it comes from- T1036Masquerading
“Hunt for Sliver implant indicators, including process masquerading and beacon traffic to 46.8.236.121:11008 / 11009 at 60-second mTLS check-in intervals.”
- T1059.003Windows Command Shell
“T1059.003”
- T1003.001LSASS Memory
“T1003.001 LSASS Memory”
- T1021.001Remote Desktop Protocol
“MSTSC tunnels Remote Desktop Protocol connections, defaulting to port 3389.”
- T1082System Information Discovery
“T1082”
- T1083File and Directory Discovery
“T1083”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“…nt monitoring (July 26, 2026), an interactive shell remained open on a compromised Ukrainian railway logistics operator, and the actor’s Sliver C2, WireGuard VPN, and 3x-ui panel were still live and responding.”
-
FamousSparrow centra sus operaciones en América Latina y despliega el nuevo backdoor SparroWocky“… originalmente en Cobalt Strike y posteriormente adoptados por otros frameworks populares de red teaming, como Brute Ratel, Metasploit y Sliver.”
-
Beware the SparroWock: The backdoor that bites, the commands that catch“…rst introduced in Cobalt Strike and have since been adopted by other popular red-teaming frameworks such as Brute Ratel, Metasploit, and Sliver.”
-
Exploits and vulnerabilities in Q2 2026“Sliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks.”
-
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor“This is not typical in public C2 frameworks such as Mythic or Sliver, which generally use gRPC for internal communication between framework components.”
-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“ShadowSyndicate continues to be associated with toolkits including Cobalt Strike, MetaSploit, Havoc, Mythic, Sliver, AsyncRAT, MeshAgent, and Brute Ratel.”
-
Cat’s Got Your Files: Lynx Ransomware“Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc.”
-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“…b504e2bbc30e23f1a15ad7b18aedb127998c79c) observed in Case #3 serves as the initial installation component, responsible for deploying the Sliver payload (SHA256: 2cd41569e8698403340412936b653200005c59f2ff3d39d203f433adb2687e7f) with C2 at keep.camdvr.org and establishing persisten…”
-
CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation“Several of these are attacks that execute Cobalt Strike beacons generated with Cross C2, deploy Nezha, Fast Reverse Proxy (FRP), the Sliver payload, and the Secret-Hunter payload.”
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc.”
-
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc.”
-
Detonating Beacons to Illuminate Detection Gaps“Loading COFF/BOF objects have become a standard feature in many C2 frameworks such as Havoc, Metasploit, PoshC2, and Sliver, with some directly utilizing COFFLoader for execution.”
-
RATs! Remote Management Software from the Hacker’s Perspective“Persistence Demo with Sliver & RAT Silent Install”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“In its attacks, ShadowSyndicate used an “off-the-shelf” toolkit, including Cobalt Strike, IcedID, and Sliver malware.”
-
Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks“…he Microsoft Common Language Runtime CLR.DLL module from a suspicious call stack (unbacked memory region with RWX permissions) using the Sliver execute-assembly command to load external .NET assemblies:”
-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“Group-IB analysts also noticed that hackers were especially interested in cross-platform, open-source frameworks such as Sliver.”
Thanks — we review every report.