This is an update to an original article I wrote mid-summer of 2024... oh what a ways we've come. Enjoy!!

TL;DR

Key Points

• Prioritize detection of modular, cloud-integrated C2 frameworks (Sliver, Havoc, Mythic, Brute Ratel C4, Cobalt Strike)
• Monitor for abuse of PowerShell/Python, in-memory payloads, and cloud APIs (Microsoft Graph, SharePoint)
• Update IR playbooks and conduct red team exercises using emerging C2 tools
• Harden EDR/XDR, restrict scripting, and enforce memory integrity controls
• Track operational overlap and tool-sharing between APT and cybercriminal groups

The story in 60 seconds

Attackers are moving away from legacy C2 tools like Cobalt Strike and Metasploit, favoring modular, open-source, and commercial frameworks—Sliver, Havoc, Mythic, and Brute Ratel C4. These frameworks offer encrypted, multi-protocol C2, in-memory payloads, and seamless integration with cloud APIs, complicating detection and response.

Recent campaigns (Ivanti zero-days, ClickFix, GOFFEE) show threat actors embedding C2 traffic within trusted cloud services, automating post-exploitation, and sharing tools across APT and cybercriminal lines. This operational convergence is accelerating, with attackers customizing agents and leveraging micro-service architectures for resilience.

Defenders must adapt by prioritizing behavioral analytics, hardening endpoints, and updating IR playbooks. The next wave of C2 frameworks is expected to leverage AI, expand multi-channel comms, and deepen OPSEC, raising the bar for detection and response.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Why it matters

SOC

• Watch for encrypted C2 over HTTP(S), DNS, and cloud APIs (Microsoft Graph, SharePoint)
• Flag reflective DLL injection, in-memory payloads, and non-standard C2 channels
• Alert on anomalous PowerShell/Python activity, especially tied to cloud service use

IR

• Preserve memory dumps and process trees for in-memory/reflective payload analysis
• Triage for persistence via renamed system daemons or cloud API abuse
• Collect forensic evidence of token manipulation and lateral movement

SecOps

• Deploy and tune EDR/XDR for in-memory and reflective injection detection
• Restrict PowerShell/Python execution; enforce application whitelisting
• Enable network segmentation and monitor for suspicious cloud service traffic

Strategic

• Invest in behavioral analytics and cloud monitoring capabilities
• Update incident response and tabletop exercises for new C2 frameworks
• Track convergence of APT and cybercrime TTPs for attribution and risk assessment

See it in your telemetry

Network

• Detect encrypted C2 over HTTP(S), DNS, and cloud APIs (Microsoft Graph, SharePoint)
• Monitor for non-standard C2 channels (Slack, Telegram, custom TCP)
• Flag anomalous traffic patterns from edge/gateway devices (Ivanti, VPNs)

Endpoint

• Alert on reflective DLL injection, in-memory payloads, and process injection (T1055)
• Monitor PowerShell/Python execution, especially with cloud service access
• Track creation of suspicious daemons or renamed system files

High Impact, Quick Wins

• Deploy YARA rules and threat intel for Sliver, Havoc, Mythic, Brute Ratel C4, and Cobalt Strike artifacts
• Restrict and monitor scripting interpreters (PowerShell, Python) on endpoints
• Conduct red team exercises using emerging C2 frameworks to validate detection and response

Research

Top 5 Emerging and Popular C2 Frameworks (2025–2026)

This analysis identifies and details the top 5 most prominent and rapidly emerging Command and Control (C2) frameworks leveraged by both nation-state/APT and cybercriminal threat actors as of late 2025 and projected into 2026. Each section provides a technical overview, unique features, adoption and trending patterns, and operational impact. All URLs have been validated for relevance and authority.

1. Sliver

Technical Overview & Unique Features:

• Sliver is an open-source, cross-platform C2 framework supporting Windows, Linux, and macOS.
• Features include modular implants, encrypted communications (MTLS, HTTP(S), DNS), dynamic operator collaboration, and in-memory payloads.
• Its rapid development and open-source nature allow for frequent updates and customization.

Adoption & Trends:

• Sliver has become a leading alternative to Cobalt Strike, widely adopted by both APT and cybercriminal actors.
• The four most frequently used frameworks — Sliver, Metasploit, Havoc, and Brute Ratel C4 — can work with exploits out of the box because their agents provide a variety of post-compromise capabilities.
• Wiz researchers found that in the recent attacks on the Ivanti zero-days, the threat actor used Sliver, a C2 framework that's popular with both red teams and cybercriminals.

Operational Impact:

• Sliver’s modularity and encrypted traffic present detection challenges for SOC analysts.
• Its use in high-profile edge device exploits and ransomware campaigns is increasing.

2. Havoc

Technical Overview & Unique Features:

• Havoc is an open-source C2 framework with a focus on stealth and evasion, supporting Windows and Linux.
• Features include a modular “Demon” agent, reflective loading, encrypted communications, and integration with Microsoft Graph API for covert C2.
• Supports advanced post-exploitation, file operations, token manipulation, and Kerberos attacks.

Adoption & Trends:

• Havoc is rapidly gaining popularity among both APT and cybercriminal groups, especially for phishing and initial access.
• The threat actor hides each malware stage behind a SharePoint site and uses a modified version of Havoc Demon in conjunction with the Microsoft Graph API to obscure C2 communications within trusted, well-known services.
• Sliver, Havoc, Metasploit, Mythic, Brute Ratel C4, and Cobalt Strike (in that order) have emerged as the most frequently used command-and-control (C2) frameworks in malicious attacks in Q2 2025, per data from Kaspersky.

Operational Impact:

• Havoc’s use of trusted cloud APIs and modular payloads complicates detection and response.
• SOC analysts must monitor for abuse of legitimate services and unusual PowerShell or Python activity.

3. Mythic

Technical Overview & Unique Features:

• Mythic is a modern, open-source C2 platform with a web-based UI, multi-user support, and a microservice architecture.
• Supports multiple agent types (Python, Go, .NET, Swift, C), encrypted communications, and advanced modular payloads.
• Notable for its support of Beacon Object Files (BOFs) and flexible communication profiles (HTTP, TCP, Slack, Telegram).

Adoption & Trends:

• Mythic is increasingly used for both red teaming and real-world attacks, especially where stealth and modularity are required.
• Our payload requirements are supported by the Mythic framework. Its microservice architecture makes it easy to add arbitrary server-side functionality. For example, the module assembly process takes place inside a container and is fully defined by us.
• Kaspersky researchers analyze GOFFEEs campaign in H2 2024: the updated infection scheme, new PowerModul implant, switch to a binary Mythic agent.

Operational Impact:

• Mythic’s modularity and support for custom communication channels make detection difficult.
• SOC teams should monitor for non-standard C2 channels and BOF-based post-exploitation.

4. Brute Ratel C4

Technical Overview & Unique Features:

• Brute Ratel C4 is a commercial C2 framework designed for red teaming, but increasingly abused by threat actors.
• Features include advanced evasion, in-memory execution, reflective DLL injection, and support for multiple communication protocols.
• Known for its OPSEC-focused design and ability to bypass EDR/AV solutions.

Adoption & Trends:

• Brute Ratel C4 is now among the top C2 frameworks used in APT and ransomware campaigns.
• The four most frequently used frameworks — Sliver, Metasploit, Havoc, and Brute Ratel C4 — can work with exploits out of the box because their agents provide a variety of post-compromise capabilities.
• Attackers are increasingly customizing their C2 agents to automate malicious activities and hinder detection.

Operational Impact:

• Brute Ratel’s advanced evasion and OPSEC features make it a high-priority detection target for SOCs.
• Analysts should monitor for reflective DLL injection and unusual in-memory activity.

5. Cobalt Strike

Technical Overview & Unique Features:

• Cobalt Strike is a commercial adversary simulation tool, long favored by both red teams and threat actors.
• Features include the Beacon agent, malleable C2 profiles, in-memory execution, and support for multiple communication protocols.
• Recent versions and cracked builds are still widely abused, but detection has improved.

Adoption & Trends:

• While detection of Cobalt Strike has improved, it remains a staple in both APT and ransomware operations, often in combination with other frameworks.
• Cobalt Strike is a commercial software framework that enables security professionals like red team members to simulate attackers embedding themselves in a network.
• UNC5221 Focuses on Ivanti Products as Cobalt Strike Is Most Frequently Associated with Post-Exploitation Activity. The threat actors ...

Operational Impact:

• Cobalt Strike’s malleable profiles and in-memory techniques require advanced behavioral analytics for detection.
• SOCs should monitor for Beacon traffic, malleable C2 profiles, and post-exploitation activity.

Comparison to Previous Years

• Cobalt Strike and Metasploit remain in use but are increasingly supplanted by open-source and customizable frameworks like Sliver, Havoc, Mythic, and Brute Ratel C4 due to improved detection of legacy tools.
• The trend is toward modular, OPSEC-focused, and cloud-integrated frameworks, with increased abuse of legitimate APIs and cloud services for C2.
• Attackers are customizing C2 agents and automating malicious activities to hinder detection and response.

Areas for Further Inquiry

• The operational overlap and tool-sharing between APT and cybercriminal groups using these frameworks.
• The evolution of detection and response strategies for modular, cloud-integrated C2 frameworks.
• The impact of AI-driven automation on C2 operations and detection.

Recommendations, Actions, Suggested Pivots, Forecasts, Next Steps and References..

Recommendations, Actions and Next Steps

1. Prioritize Detection and Response for Cloud-Integrated and Modular C2 Frameworks

   • Deploy and continuously tune behavioral analytics and network monitoring to detect C2 activity leveraging cloud APIs (e.g., Microsoft Graph, SharePoint) and modular frameworks (Sliver, Havoc, Mythic, Brute Ratel C4, Cobalt Strike). For example, the 2025 ClickFix campaign used PowerShell to download and execute Havoc C2 via SharePoint and Microsoft Graph, embedding C2 traffic within legitimate cloud service communications to evade detection.
   • Implement detection rules for suspicious PowerShell and Python activity, abuse of trusted cloud services, and non-standard C2 channels. Leverage YARA rules and threat intelligence from Mandiant/Google GTI for emerging indicators (e.g., Sliver implants masquerading as system files, as seen in Ivanti zero-day exploitation).
   • Expected impact: Increases visibility into advanced C2 operations, reduces attacker dwell time, and enables earlier disruption of both APT and cybercriminal campaigns.
   • Potential challenges: Requires ongoing tuning, staff training, and investment in next-gen monitoring; may increase false positives due to legitimate cloud service use.
   • Metrics for success: Reduction in mean time to detect (MTTD) C2 activity, increased detection rates of cloud-based C2, and successful identification of C2 channels in red team exercises.
   • MITRE ATT&CK IDs: T1071, T1102, T1573, T1568, T1059.

2. Harden Endpoint and Network Defenses Against In-Memory and Reflective Payloads

   • Deploy EDR/XDR solutions capable of detecting in-memory execution, reflective DLL injection, and modular payloads. Mandiant observed Sliver and custom malware deployed as persistent daemons and masquerading as system files during Ivanti zero-day exploitation.
   • Enforce application whitelisting, restrict PowerShell/Python execution, and enable memory integrity controls. Conduct regular threat hunting for indicators of reflective loading, process injection, and suspicious parent-child process relationships.
   • Expected impact: Reduces risk of successful post-compromise activity and lateral movement by advanced C2 agents.
   • Potential challenges: May require tuning to avoid business disruption; legacy systems may lack support for advanced controls.
   • Metrics for success: Decrease in successful in-memory payload executions, increased detection of reflective DLL injection attempts, improved EDR/XDR alert fidelity.
   • MITRE ATT&CK IDs: T1055, T1027, T1218, T1059.

3. Develop and Exercise Incident Response Playbooks for Emerging C2 Frameworks

   • Create and maintain playbooks for rapid response to incidents involving Sliver, Havoc, Mythic, Brute Ratel C4, and Cobalt Strike, including containment, eradication, and forensic investigation. Mandiant’s case studies show that rapid identification and removal of persistent C2 implants (e.g., Sliver, SPAWN malware) is critical to prevent lateral movement and long-term compromise.
   • Integrate threat intelligence feeds from diverse sources (Mandiant, CISA, BleepingComputer) and conduct regular tabletop exercises and red team simulations using these frameworks to validate detection and response.
   • Expected impact: Improves organizational readiness, accelerates incident response, and ensures alignment with the evolving threat landscape.
   • Potential challenges: Requires cross-team coordination, ongoing playbook updates, and investment in threat intelligence resources.
   • Metrics for success: Reduced mean time to respond (MTTR) to C2-related incidents, successful completion of tabletop exercises, regular updates to playbooks based on new intelligence.
   • MITRE ATT&CK IDs: T1482, T1566, T1589, T1608.

Suggested Pivots

1. What specific behavioral analytics, YARA rules, and anomaly detection techniques can SOC teams implement to improve detection of encrypted and modular C2 frameworks like Sliver and Mythic, especially those using non-standard communication channels and in-memory payload execution?

2. How do nation-state APT groups and cybercriminal threat actors share and customize emerging C2 frameworks such as Havoc and Brute Ratel C4? Can we identify case studies or campaigns that illustrate this operational overlap and tool-sharing?

3. How should incident response playbooks be updated to address the increasing use of legitimate cloud services and APIs (e.g., Microsoft Graph API, SharePoint) by C2 frameworks for covert communications, including specific containment and forensic investigation strategies?

Forecast

Short-Term Forecast (3-6 months)

• Widespread Adoption of Modular, Cloud-Integrated C2 Frameworks: Expect increased use of modular C2 frameworks such as Sliver, Havoc, Mythic, and Brute Ratel C4 by both APT and cybercriminal groups. These frameworks’ ability to leverage legitimate cloud services (e.g., Microsoft Graph API, SharePoint) for covert C2 communications will challenge traditional detection methods, requiring SOCs to enhance behavioral analytics and cloud service monitoring.

• Increased Use of Scripting and In-Memory Execution Techniques: PowerShell and Python abuse for C2 deployment and control will rise, as demonstrated by the 2025 ClickFix campaign using Havoc C2 via SharePoint. In-memory payload execution and reflective DLL injection, core to frameworks like Brute Ratel C4 and Cobalt Strike, will remain prevalent, necessitating advanced EDR/XDR capabilities and threat hunting focused on these techniques.

• Operational Convergence Between APT and Cybercriminal Actors: The sharing and customization of C2 frameworks across nation-state and financially motivated groups will increase, complicating attribution and response. This convergence will drive the development of more sophisticated, automated, and evasive C2 operations.

• Heightened Focus on Edge and Gateway Device Exploitation: Vulnerabilities in edge security appliances and remote access tools (e.g., Ivanti Connect Secure) will continue to be prime targets, with threat actors deploying advanced C2 frameworks post-exploitation to maintain persistence and move laterally.

Examples

• Mandiant’s 2024-2025 investigations of Ivanti zero-day exploitation campaigns deploying Sliver implants as persistent daemons.
• The 2025 ClickFix campaign’s use of Havoc C2 embedded in Microsoft SharePoint and Graph API for stealthy communications.
• Recorded Future’s H1 2025 data showing Cobalt Strike as the most frequently associated malware with post-exploitation activity.
• Kaspersky’s analysis of Mythic’s microservice architecture enabling flexible, modular payloads and covert communication channels.

What to Watch Out For

• Detection of anomalous PowerShell/Python activity linked to cloud API abuse.
• Increased alerts for reflective DLL injection and in-memory execution in EDR/XDR telemetry.
• Intelligence reports indicating shared C2 tooling or infrastructure between APT and cybercriminal groups.
• Exploitation trends targeting edge devices and gateway appliances, especially involving Ivanti and similar vendors.

Long-Term Forecast (12-24 months)

• Emergence of AI-Enhanced C2 Frameworks and Automation: Building on current trends in automation and modularity, threat actors are likely to integrate AI and machine learning to automate C2 agent customization, evasion, and attack orchestration. While direct evidence of AI-powered C2 frameworks is limited, the increasing use of AI in malware development and evasion (e[.]g., as reported by Recorded Future and Unit 42 in 2025) supports this trajectory.

• Expansion of Multi-Protocol and Multi-Channel C2 Communications: C2 frameworks will evolve to support a broader range of communication channels, including encrypted messaging platforms (Slack, Telegram), IoT protocols, and emerging cloud services. Mythic’s current support for Slack and Telegram as C2 channels exemplifies this trend.

• Proliferation of Microservice and Containerized Architectures in C2 Platforms: Inspired by Mythic’s microservice design, future C2 frameworks will adopt containerized and microservice architectures to enable rapid development, modularity, and resilience against takedown efforts, complicating detection and disruption.

• Increased Sophistication in OPSEC and Evasion Techniques: Advanced evasion methods such as polymorphic payloads, dynamic malleable C2 profiles, and abuse of legitimate enterprise tools will become standard. This will require SOCs to adopt AI-driven behavioral analytics and anomaly detection at scale.

• Deepening Collaboration and Tool Sharing Among Threat Actors: The operational overlap between APT and cybercriminal groups will intensify, with shared development of C2 frameworks and post-exploitation tools, increasing the sophistication and reach of attacks.

Examples

• Mythic’s microservice architecture enabling flexible server-side functionality and covert communication channels (Slack, Telegram).
• Recorded Future and Unit 42 reports on AI-assisted malware development and evasion techniques in 2025.
• The ongoing use and adaptation of Cobalt Strike’s malleable C2 profiles despite improved detection, indicating evolution rather than obsolescence.
• Documented cases of multi-channel C2 communications leveraging cloud APIs and messaging platforms.

What to Watch Out For

• Emergence of AI-driven C2 frameworks or automation tools in threat intelligence reports.
• New C2 platforms adopting microservice or containerized architectures.
• Increased use of encrypted, multi-protocol C2 channels beyond HTTP(S) and DNS.
• Evidence of collaborative tool development or shared infrastructure between APT and cybercriminal groups.
• Adoption of AI-based detection and response tools by SOCs.

MITRE ATT&CK IDs

T1071, T1102, T1055, T1059, T1134, T1482, T1566, T1589, T1608, S0154, S0633, S1063, TA0011, TA0002

Appendix

References

1. (2025-08-27) - Exploits and vulnerabilities in Q2 2025 | Kaspersky Securelist
2. (2025-05-21) - Ivanti EPMM Exploitation Tied to Previous Zero-Day Attacks | Dark Reading
3. (2025-03-03) - Hackers Use ClickFix Trick to Deploy PowerShell-Based Havoc C2 via SharePoint Sites | The Hacker News
4. (2025-09-08) - Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More | The Hacker News
5. (2025-05-13) - Using a Mythic agent to optimize penetration testing | Kaspersky Securelist
6. (2024-12-19) - GOFFEE continues to attack organizations in Russia | Kaspersky Securelist
7. (2024-06-26) - Attackers Exploiting Public Cobalt Strike Profiles | Unit 42, Palo Alto Networks
8. (2025-08-28) - H1 2025 Malware and Vulnerability Trends | Recorded Future
9. (2025-03-03) - New ClickFix attack deploys Havoc C2 via Microsoft SharePoint | BleepingComputer
10. (2024-04-04) - Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies | Google Cloud Blog (Mandiant)
11. (2023-09-21) - APT29's Rapidly Evolving Diplomatic Phishing Operations | Google Cloud Blog (Mandiant)

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

(c) 2025 CSIRT Gadgets, LLC

MITRE ATT&CK

Techniques

1. T1071 (Application Layer Protocol)

   • All five C2 frameworks (Sliver, Havoc, Mythic, Brute Ratel C4, Cobalt Strike) use HTTP(S), DNS, and other application protocols for C2. For example, Sliver was used in the 2025 Ivanti zero-day attacks to establish encrypted C2 over HTTP(S) (Dark Reading, 2025), and Havoc leveraged Microsoft Graph API and SharePoint for covert C2 (The Hacker News, 2025). Brute Ratel C4 and Cobalt Strike are also frequently observed using malleable C2 profiles over HTTP(S) (Kaspersky Securelist, 2025).
   • Kaspersky Securelist, 2025
   • The Hacker News, 2025
   • Dark Reading, 2025

2. T1055 (Process Injection)

   • Reflective DLL injection and in-memory payload execution are core to Brute Ratel C4, Cobalt Strike, and Sliver, enabling evasion and post-exploitation. Brute Ratel C4 is specifically noted for reflective DLL injection (MITRE ATT&CK: Brute Ratel C4), and Cobalt Strike is widely documented for process injection (Unit 42, 2024).
   • MITRE ATT&CK: Brute Ratel C4
   • Unit 42, 2024
   • Kaspersky Securelist, 2025

3. T1059 (Command and Scripting Interpreter)

   • PowerShell (T1059.001), Python (T1059.006), and Cloud API (T1059.009) are abused by these frameworks for execution and C2. The 2025 ClickFix campaign used PowerShell to deploy Havoc via SharePoint and Microsoft Graph (BleepingComputer, 2025), and Mythic supports Python and Go agents (Kaspersky Securelist, 2025).
   • BleepingComputer, 2025
   • Kaspersky Securelist, 2025
   • The Hacker News, 2025

Tactics

1. TA0011 (Command and Control)

   • All identified C2 frameworks are designed to establish and maintain C2 channels, often using encrypted and modular protocols. The 2025 Kaspersky report highlights the prevalence of these frameworks in C2 operations (Kaspersky Securelist, 2025).
   • Kaspersky Securelist, 2025

2. TA0002 (Execution)

   • Execution of payloads via scripting interpreters and in-memory techniques is a primary function of these frameworks. The ClickFix campaign is a recent example (BleepingComputer, 2025).
   • BleepingComputer, 2025

3. TA0005 (Defense Evasion)

   • Reflective/in-memory techniques, encrypted C2, and abuse of trusted cloud APIs are used to evade detection. Brute Ratel C4 and Cobalt Strike are specifically designed for OPSEC and evasion (The Hacker News, 2025).
   • The Hacker News, 2025

Procedures

1. T1055.001 (Dynamic-link Library Injection)

   • Brute Ratel C4 and Cobalt Strike use reflective DLL injection for in-memory execution and evasion. This is highlighted in both MITRE and vendor analysis (MITRE ATT&CK: Brute Ratel C4), (Kaspersky Securelist, 2025).
   • MITRE ATT&CK: Brute Ratel C4
   • Kaspersky Securelist, 2025

2. T1071.001 (Web Protocols)

   • Havoc and others use HTTP(S) (including Microsoft Graph API and SharePoint) for covert C2. The ClickFix campaign is a recent example (The Hacker News, 2025), (BleepingComputer, 2025).
   • The Hacker News, 2025
   • BleepingComputer, 2025

3. T1134 (Access Token Manipulation)

   • Havoc and similar frameworks support token manipulation for privilege escalation and evasion. This is referenced in the technical overview of Havoc (The Hacker News, 2025) and in MITRE documentation (MITRE ATT&CK: Access Token Manipulation).
   • The Hacker News, 2025
   • MITRE ATT&CK: Access Token Manipulation

Software

1. S0154 (Cobalt Strike)

   • Commercial C2 platform, widely abused for post-exploitation, reflective DLL injection, and malleable C2 profiles. Used in the 2025 Ivanti and UNC5221 campaigns (Recorded Future, 2025), (Unit 42, 2024).
   • Recorded Future, 2025
   • Unit 42, 2024

2. S0633 (Sliver)

   • Open-source, modular C2 framework, increasingly used in real-world attacks and red teaming. Used in 2025 Ivanti zero-day exploitation (Dark Reading, 2025), (Kaspersky Securelist, 2025).
   • Dark Reading, 2025
   • Kaspersky Securelist, 2025

3. S1063 (Brute Ratel C4)

   • Commercial C2 tool with advanced evasion, reflective DLL injection, and modular payloads. Used in ransomware and APT campaigns in 2025 (Kaspersky Securelist, 2025), (The Hacker News, 2025).
   • Kaspersky Securelist, 2025
   • The Hacker News, 2025

Mitigations

1. M1040 (Network Segmentation)

   • Limits lateral movement and C2 communication by segmenting critical assets and monitoring network traffic. Recommended in Mandiant’s 2024 Ivanti case studies (Google Cloud Blog, 2024).
   • Google Cloud Blog, 2024

2. M1026 (Privileged Account Management)

   • Restricts abuse of token manipulation and privilege escalation by enforcing least privilege and monitoring account use. Highlighted in Kaspersky’s 2025 recommendations (Kaspersky Securelist, 2025).
   • Kaspersky Securelist, 2025

3. M1047 (Audit)

   • Enables detection of suspicious process injection, script execution, and C2 activity through comprehensive logging and alerting. Recommended by Mandiant and Google GTI (Google Cloud Blog, 2024).
   • Google Cloud Blog, 2024

Groups

1. G0016 APT29 (Cozy Bear, Nobelium, The Dukes)

   • Used Cobalt Strike and Sliver in high-profile campaigns, including SolarWinds and 2025 Ivanti exploitation (Kaspersky Securelist, 2025), (Dark Reading, 2025).
   • Kaspersky Securelist, 2025
   • Dark Reading, 2025

2. G0080 Cobalt Group

   • Uses Cobalt Strike for C2 and post-exploitation in financially motivated attacks. Referenced in MITRE and recent threat intelligence (Recorded Future, 2025).
   • Recorded Future, 2025

3. G1021 Cinnamon Tempest

   • Associated with Sliver C2 usage in recent campaigns, as documented in MITRE and Kaspersky’s 2025 reporting (Kaspersky Securelist, 2025).
   • Kaspersky Securelist, 2025