Nighthawk is more likely to turn out to be hackers’ new post-exploitation software after Cobalt Strike

November 23, 2022Ravie Lakshmanan

A nascent and legit penetration testing framework often known as nightjar is more likely to entice the eye of menace actors for its Cobalt Strike-like skills.

Enterprise safety agency Proofpoint mentioned it detected use of the software program in mid-September 2022 by a purple workforce with quite a few check emails despatched utilizing generic topic strains resembling ” Simply test in” and “Hope this works2”.

Nonetheless, there isn’t a proof that any leaked or cracked model of Nighthawk is weaponized by menace actors within the wild, Proofpoint researcher Alexander Rausch mentioned in a paper.

Nighthawk, launched in December 2021 by an organization known as MDSec, is analogous to its counterparts Cobalt Strike, Sliver, and Brute Ratel, providing a purple workforce toolset for simulating adversary threats. It’s licensed for £7,500 (or $10,000) per consumer for one yr.

“Nighthawk is essentially the most superior and evasive command and management framework accessible in the marketplace,” MDSec notes. “Nighthawk is a extremely malleable implant designed to bypass and evade trendy safety controls typically seen in mature, extremely guarded environments.”

Based on the Sunnyvale-based firm, the aforementioned emails contained booby-trapped URLs that, when clicked, redirected recipients to an ISO picture file containing the Nighthawk loader.

The Obfuscated Loader ships with the Nighthawk Encrypted Payload, a C++-based DLL that makes use of an elaborate set of options to counter detection and fly below the radar.

Of explicit notice are mechanisms that may forestall endpoint detection options from being alerted to newly loaded DLLs within the working course of and keep away from course of reminiscence scans by implementing a self-encrypting mode.

When contacted for remark, MDSec instructed The Hacker Information that it’s not conscious of any situations of Nighthawk getting used for illegitimate exercise and that licenses are solely distributed to a handful of customers. tightly managed clients.

With rogue actors already leveraging cracked variations of Cobalt Strike and others to additional their post-exploitation actions, Nighthawk may additionally see comparable adoption by teams looking for to “diversify their strategies and add a comparatively unknown framework to their arsenal.

Certainly, the excessive detection charges related to Cobalt Strike and Sliver have led Chinese language prison actors to design different offensive frames like Manjusaka and Alchimist in latest months.

“Nighthawk is a mature and superior industrial C2 framework for purple workforce forensic operations, purpose-built for detection evasion, and it does it effectively,” Rausch mentioned.

“The historic adoption of instruments like Brute Ratel by superior adversaries, together with these aligned with state pursuits and fascinating in espionage, supplies a template for doable future developments within the menace panorama.”