Chisel

Reported Context (7)

Before its removal, the GitHub repository also hosted an in-memory wrapper that executed the open-source Chisel tunneling utility. Iranian-Aligned Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure
though other attacks like Pass-the-Hash were also observed. Open source network tunnel utility Chisel was used to facilitate remote RDP sessions. Many hosts had malicious scheduled tasks executing obfuscated Report Traces ShinyHunters’ Six-Year Evolution and Changing Attack Tactics
AS56694 and AS49505, SSH/SFTP-based exfiltration infrastructure within AS50340, and AS62212 hosting a Chisel implant chained with a Cloudflare Worker to establish a reverse SOCKS proxy, which is a notably more Team Cymru Details Ransomware Infrastructure Trends Across 20+ Investigations
and used them to run discovery commands, attempt credential access, and execute an off-the-shelf build of Chisel, an open-source TCP tunnelling tool. Sophos Finds Fake AI Installers Dominated Malware Cases
across the codebases: compromise the device, enable a SOCKS5 proxy on it, and report the result back to a chisel reverse-tunnel listener on the server's port at 4444. The operator's objective is a pool of SOCKS5 Research details toolkits targeting Ukrainian IP cameras and routers

CVE (13)

Malware (16)

People (2)

Threat Actors (34)

MITRE ATT&CK (58)

Vendors (32)

Products (51)

Tools (37)

Industries (9)

Countries (31)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.