A Windows post-exploitation toolkit linked to a ransomware investigation used reverse shells, credential theft utilities, service masquerading and Ethereum-based command-and-control infrastructure to maintain access inside a targeted network.
The investigation initially classified two dozen numbered binaries as probable Sliver implants. However, later analysis found that the files were not Sliver payloads.
They were plain reverse shells designed to provide attackers with remote command execution on compromised Windows systems.
This correction is important because the first analysis relied on a limited review method. Analysts used a string-tokenisation approach that failed to identify addresses stored inside Go language pooled string blobs.
As a result, the binaries were incorrectly reported as containing no command-and-control addresses.
Further inspection showed that every analysed reverse shell contained its own C2 address in clear text. The addresses were not hidden through encryption or complex obfuscation.
Instead, they were missed because the extraction method could not view the relevant substring within the compiled Go binary data.
The case highlights a common incident-response issue, an empty result does not always confirm the absence of malicious content.
Detection and forensic tools must clearly state what data they inspected, what formats they support and where their visibility ends.
Hackers Weaponize Ethereum C2
The attackers also used Mimikatz, a widely known credential-dumping tool, during post-exploitation activity.
Mimikatz can be used to extract credentials, password hashes and authentication material from Windows systems, enabling attackers to move laterally or gain broader control over a victim environment.
The toolset reportedly included reverse-SOCKS activity, allowing operators to route traffic through compromised systems. This technique can help attackers access internal services that are not directly exposed to the internet.
It may also support lateral movement, remote administration and data collection while reducing the need for direct external connections.
Researchers also observed service masquerading and task names that matched a known operational pattern connected to a published ransomware incident.
These similarities provide supporting evidence of a possible relationship between the activity clusters. However, the overlap does not prove that the same threat actor or victim organisation was involved.
The campaign’s infrastructure included Ethereum-based C2 elements.
Blockchain-backed C2 mechanisms can complicate disruption efforts because attackers may use smart-contract data or blockchain transactions to distribute configuration details, operational commands or updated infrastructure information.
Investigators identified four contract constants shared across four publicly known contracts in the same family.
However, researchers said they could not confirm whether this fingerprint was unique across the full Ethereum blockchain. The comparison covered only the known contract set, not every potentially related contract, hunters said.
Several investigative questions remain open. Four file hashes shared between IP address 77.110.126.46 and a seized domain remain unidentified. This is a named intelligence gap, not confirmation that the hashes are harmless or unrelated.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
