ClearSky Lebanese Cedar Jan 2021

Caterpillar WebShell has a module to collect information from the local database.

Caterpillar WebShell can obtain a list of the services from a system.

Caterpillar WebShell has a module to use a rootkit on a system.

Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.

Caterpillar WebShell can obtain a list of user accounts from a victim's machine.

Caterpillar WebShell can upload files over the C2 channel.

Caterpillar WebShell has a module to use a port scanner on a system.

Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.

Caterpillar WebShell can gather a list of processes running on the machine.

Caterpillar WebShell can run commands on the compromised asset with CMD functions.

Caterpillar WebShell can obtain a list of local groups of users from a system.

Caterpillar WebShell has a module to gather information from the compromised asset, including the computer version, computer name, IIS version, and more.

Caterpillar WebShell can search for files in directories.

Caterpillar WebShell has a module to download and upload files to the system.

Volatile Cedar can deploy additional tools.

Caterpillar WebShell has a module to perform brute force attacks on a system.

Caterpillar WebShell has a command to modify a Registry key.

Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.

Volatile Cedar can inject web shell code into a server.

Explosive has encrypted communications with the RC4 method.

Volatile Cedar has performed vulnerability scans of the target server.

Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.