PoshC2

MITRE ATT&CK: S0378 View on attack.mitre.org

Aliases: PoshC2

First seen
2018-01-01 00:00:00
Malware type
rat, dropper
Family
Malware family
Operating systems
windows, linux, macos
Related IoCs
78 (8 malicious)
Last IoC activity
2026-10-17 09:16:05
Profile updated
2026-07-07 12:42:37

Context

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.

Recent IoC activity

8 malicious indicators in Maltiverse are attributed to PoshC2 (S0378). The 8 most recently updated:

TypeIndicatorUpdatedSources
IP address 143.110.219.27 2026-10-14 7
IP address 146.190.247.89 2026-10-08 1
IP address 137.184.139.185 2026-10-05 1
IP address 159.223.145.166 2026-09-30 2
file sample 22ae11d4d8971b1b1bc2c80b7a70e59dadd6112bc1ecfce750093d1d5f87e27f 2026-09-17 1
hostname finix.newsnewth365.com 2026-09-03 1
file sample KTJ8zjM1.posh 2026-08-19 1
file sample nVX7Zrz0.posh 2026-03-24 2

Detection coverage

  • 1 YARA rules
  • 595 Sigma rules

Malware & tools used

  • System Network Configuration Discovery (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Name Resolution Poisoning and SMB Relay (attack-pattern)
  • Web Protocols (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Exploitation for Privilege Escalation (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Create Process with Token (attack-pattern)
  • Bypass User Account Control (attack-pattern)
  • Service Execution (attack-pattern)
  • Local Account (attack-pattern)
  • Automated Collection (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Keylogging (attack-pattern)
  • Domain Account (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Pass the Hash (attack-pattern)
  • Local Groups (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Proxy (attack-pattern)
  • Brute Force (attack-pattern)
  • LSASS Memory (attack-pattern)
  • Process Injection (attack-pattern)
  • Exploitation of Remote Services (attack-pattern)

Used by threat actors

Detection rules

  • SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc (yara-rule)

Reports & references

  • secureworks.com — Cobalt Trinity (report)
  • research.checkpoint.com — Dangeroussavanna Two Year Long Campaign Targets Financial Institutions In French Speaking Africa (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Poshc2 (report)
  • rewterz.com — Rewterz Threat Alert Iranian Apt Uses Job Scams To Lure Targets (report)
  • github.com — Poshc2 Python (report)
  • github.com — Poshc2 Apt 33.Md (report)
  • labs.nettitude.com — Detecting Poshc2 Indicators Of Compromise (report)
  • ti.dbappsecurity.com.cn — Operation Maskface (report)
  • MITRE ATT&CK — S0378 (report)
  • jsac.jpcert.or.jp — Jsac2020 0 Jpcert En (report)
  • go.recordedfuture.com — Cta 2021 0107 (report)
  • Mandiant — Scandalous External Detection Using Network Scan Data And Automation (report)
  • Mandiant — Overruled Containing A Potentially Destructive Adversary (report)
  • blogs.vmware.com — Detecting Threats In Real Time With Active C2 Information (report)
  • jsac.jpcert.or.jp — Jsac2024 1 9 Takeda Furukawa En (report)
  • michaelkoczwara.medium.com — Hunting C2 With Shodan 223Ca250D06F (report)
  • redcanary.com — Getsystem Offsec (report)
  • 5851803.fs1.hubspotusercontent-na1.net — Russian%20Ransomware%20C2%20Network%20Discovered%20In%20Censys%20Data (report)
  • paper.seebug.org — 1301 (report)
  • censys.com — Russian Ransomware C2 Network Discovered In Censys Data (report)

External references