Attacker Tool & Framework Catalog¶

1. Tool Taxonomy¶

The attacker tooling ecosystem spans eight functional categories, from initial exploitation through persistence and defense evasion.

mindmap
  root((Attacker<br/>Tool Taxonomy))
    Exploit Frameworks
      Metasploit
      Custom zero-day exploits
      Browser exploit kits
    C2 Frameworks
      Cobalt Strike
      Brute Ratel C4
      Sliver
      Mythic
      Custom implants
    Post-Exploitation
      Mimikatz
      Impacket
      BloodHound
      PowerSploit
    Credential Access
      LaZagne
      HYPERSCRAPE
      Kerberoasting tools
      Browser stealers
    Lateral Movement
      PsExec
      WMI/WMIC
      RDP abuse
      SSH tunneling
    Defense Evasion
      BYOVD tools
      DLL side-loading
      Process injection
      Timestomping
    Reconnaissance
      SharpHound
      Network scanners
      Cloud enumeration
    Loaders & Droppers
      QakBot
      IcedID
      Emotet
      BumbleBee

2. Master Tool Catalog¶

Exploit Frameworks¶

C2 Frameworks¶

Post-Exploitation & Credential Access¶

Lateral Movement¶

Defense Evasion¶

Loaders & Droppers¶

Custom Malware Families¶

3. Shared Tooling Analysis¶

The Supply Chain of Attacker Tooling¶

The attacker tooling ecosystem has its own supply chain dynamics:

• Leaked tools: Cobalt Strike source code leaked in 2020; cracked versions distributed freely. Brute Ratel C4 was cracked and leaked within months of gaining traction. Each leak permanently expands the attacker toolkit available to lower-skill actors.
• Open-source proliferation: Tools like Sliver, Mythic, and Havoc are developed openly on GitHub. While created for legitimate red team use, they are immediately available to adversaries with no licensing friction.
• Forum-sold tooling: BYOVD tools (Terminator, AuKill), custom packers, and EDR bypass kits are sold on Russian-language forums (XSS, Exploit) for $300--$5,000.
• Malware-as-a-Service loaders: QakBot, IcedID, BumbleBee, and Emotet operated as commercial services providing initial access to paying customers --- primarily ransomware affiliates.

This supply chain means that a disruption at any single tool only temporarily degrades attacker capability. When QakBot was taken down in August 2023, ransomware affiliates shifted to IcedID, BumbleBee, and Pikabot within weeks.

The Cobalt Strike Problem¶

Cobalt Strike exemplifies the "shared tooling" challenge. Originally a legitimate red team tool, cracked and leaked versions have proliferated since approximately 2020. Fortra (the vendor) and law enforcement have attempted takedowns of pirated Cobalt Strike infrastructure, but the tool remains ubiquitous across the threat landscape.

• Estimated 70%+ of targeted intrusions in 2024 involved Cobalt Strike at some phase (Google TAG / VirusTotal analysis)
• Fortra and Microsoft coordinated legal action in 2023 to seize infrastructure hosting cracked copies
• Despite enforcement efforts, cracked builds remain freely available on underground forums

ShadowPad: China's Shared Malware Service¶

ShadowPad functions as a shared malware platform across PRC-linked groups --- a "malware-as-a-service" for the Chinese intelligence community. First identified in supply chain attacks in 2017 (NetSarang and CCleaner compromises), it has since been adopted by at least 15 distinct PRC-attributed groups.

• Modular plugin architecture allows different teams to customize functionality
• Central development and distribution suggests institutional coordination across MSS and PLA cyber units
• Represents a maturation of China's offensive cyber program toward shared infrastructure and reduced duplication (Recorded Future, 2023; PwC Threat Intelligence, 2022)

Tool Convergence Trend¶

Nation-state actors are increasingly adopting commodity and open-source tools that were historically associated with cybercriminals:

4. LOTL Binary Catalog¶

Living-off-the-land (LOTL) techniques use legitimate system binaries and administrative tools for malicious purposes, blending attacker activity with normal operations.

5. Tool Evolution Trends¶

Custom Malware in Decline for Initial Access¶

Nation-state actors increasingly use commodity tools for initial access and early kill chain phases, reserving custom malware for later-stage persistence and high-value targets. This is a deliberate tradecraft shift --- commodity tools provide plausible deniability and reduce the risk of burning expensive custom capabilities.

• China post-2020: Volt Typhoon operates almost entirely with LOTL and commodity tools; custom implants are reserved for high-priority persistent access (Microsoft Threat Intelligence, 2023)
• Exception: supply chain attacks still require custom implants (SUNBURST, 3CX compromise)

Commodity/OSS C2 Framework Adoption Rising¶

LOTL Usage Intensifying¶

Chinese threat actors in particular have dramatically increased LOTL usage since approximately 2020, coinciding with the Volt Typhoon campaign's focus on U.S. critical infrastructure pre-positioning. This shift represents a strategic adaptation to improved Western detection of Chinese custom malware.

• Pre-2020: PRC groups relied heavily on custom backdoors (PlugX, ShadowPad, China Chopper)
• Post-2020: Volt Typhoon and related clusters use almost exclusively built-in Windows tools
• Other actors are following: DPRK and Iran groups also increasing LOTL adoption

BYOVD Emerging as Standard EDR Bypass¶

Bring Your Own Vulnerable Driver (BYOVD) attacks --- where attackers load legitimately signed but vulnerable kernel drivers to disable security tools --- have moved from niche technique to standard ransomware playbook in 2023--2025.

• Terminator tool (using a vulnerable Zemana driver) sold openly on cybercrime forums for $3,000
• AuKill leverages vulnerable Process Explorer drivers to kill EDR processes
• LOLDrivers project (loldrivers.io) catalogs 700+ vulnerable drivers
• Microsoft's Vulnerable Driver Blocklist is the primary mitigation but adoption is inconsistent

Cloud-Native Tooling in Attacks¶

As enterprises migrate to cloud, attackers are following with cloud-native techniques:

• Azure CLI, AWS CLI, gcloud: Used for cloud reconnaissance, privilege escalation, and data exfiltration
• Azure AD / Entra ID abuse: Token theft, OAuth app abuse, consent phishing
• Cloud-specific tools: ROADtools (Azure AD enumeration), Pacu (AWS exploitation framework), ScoutSuite
• Russia (APT29) and DPRK are the most active cloud-targeting nation-state actors

Cross-Platform Malware Rising¶

Malware written in Rust and Go is increasing across all actor categories, enabling single-codebase targeting of Windows, Linux, and macOS:

• Royal/BlackSuit ransomware: Rust-based encryptor targeting both Windows and Linux/ESXi
• BlackCat/ALPHV: First major ransomware written in Rust (2021)
• Sliver, Mythic agents: Go-based, inherently cross-platform
• DPRK loaders: Multiple DPRK campaigns now use Go-based initial access tools

Tool Disruption Effectiveness¶

Law enforcement and vendor actions have had mixed results against the attacker tooling supply chain:

The pattern is clear: disruption works best against centralized infrastructure (C2 servers, loader botnets) and works poorly against distributed knowledge (LOTL techniques, open-source tools, leaked source code). This asymmetry favors continued attacker adoption of decentralized, commodity tooling.

6. Sources¶

1. MITRE ATT&CK --- Software and Tools: https://attack.mitre.org/software/
2. Google TAG Cobalt Strike abuse analysis: https://blog.google/threat-analysis-group/google-tag-efforts-to-counter-cobalt-strike-abuse/
3. CISA Advisory AA24-038A --- PRC State-Sponsored Actors (Volt Typhoon): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
4. Microsoft Threat Intelligence --- Volt Typhoon LOTL analysis (2023): https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
5. Recorded Future --- ShadowPad malware analysis: https://www.recordedfuture.com/research/shadowpad-malware-analysis
6. PwC Threat Intelligence --- ShadowPad technical report (2022): https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/shadow-pad.html
7. LOLDrivers Project --- Vulnerable driver catalog: https://www.loldrivers.io/
8. CrowdStrike Global Threat Report 2024: https://www.crowdstrike.com/global-threat-report/
9. Mandiant APT Groups reference: https://www.mandiant.com/resources/insights/apt-groups
10. Chainalysis --- Crypto hacking and stolen funds 2025: https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/
11. LOLBAS Project --- Living Off The Land Binaries, Scripts and Libraries: https://lolbas-project.github.io/
12. Fortra / Microsoft coordinated legal action against Cobalt Strike abuse (2023): https://www.fortra.com/newsroom/fortra-takes-legal-action-against-illegal-cobalt-strike-use

Glossary¶

This glossary defines the acronyms and key terms used throughout the cybersecurity market research site. Use it as a quick reference when navigating segment analyses, pain-point discussions, and opportunity assessments.

A¶

B¶

C¶

D¶

E¶

F/G¶

H¶

I¶

L¶

M¶

N¶

O¶

P¶

R¶

S¶

T¶

V¶

X¶

Z¶