This script in turn downloaded and executed a PowerShell backdoor known as POSHC2, a proxy-aware C&C framework, from the C&C server.
PoshC2
PoshC2 is an open-source command-and-control framework and PowerShell-based implant used for post-exploitation on Windows systems.
Profile source: Mallory opens in a new tabPoshC2
Family profile
PoshC2 is an open-source command-and-control framework and PowerShell-based implant used for post-exploitation on Windows systems. It is commonly treated as offensive security tooling, but it has also been used in real intrusions by threat actors including APT33/Elfin. The framework supports command-and-control over HTTP and HTTPS and includes proxy-aware communications options to operate in restricted enterprise environments.
PoshC2 provides a broad set of post-compromise capabilities. Documented functionality includes local and domain account enumeration, service and service-permission enumeration, port scanning, password discovery in local and remote files, decryption of credentials stored by Remote Desktop Connection Manager, process injection through modules such as Invoke-PSInject, and task execution via WMI. It also includes modules for privilege escalation to NT AUTHORITY\\SYSTEM through PowerSploit-derived Get-System functionality and can establish persistence through WMI events. Additional collection-oriented modules include recursive searching of files and directories for payment-card data and packet-capture capability on compromised hosts.
Operationally, PoshC2 is associated with Windows-centric intrusions and is frequently grouped with other dual-use C2 frameworks such as Cobalt Strike, Empire, Covenant, Mythic, and Sliver. In observed malicious use, it has been delivered as a PowerShell backdoor and used alongside scheduled-task persistence, credential dumping, defense-evasion measures, and follow-on deployment of additional implants and exfiltration tooling. Its combination of modular post-exploitation features, native Windows tradecraft, and flexible C2 transport has made it useful both for red-team operations and for adversaries conducting espionage or broader enterprise compromise.
Capabilities
- Brute Force
- Credential Theft
- Defense Evasion
- Exfiltration
- Persistence
- Privilege Escalation
- Process Injection
- Reconnaissance
- Scanning
Reported operators
Threat actors
1 named in public reportingExploited software
Vulnerabilities linked to PoshC2
3 CVEsMITRE ATT&CK
PoshC2 in ATT&CK
45 distinct techniquesTechniques
45 techniques T1574 Hijack Execution Flow T1082 System Information Discovery T1071 Application Layer Protocol T1083 File and Directory Discovery T1071.001 Web Protocols T1119 Automated Collection T1016 System Network Configuration Discovery T1087.002 Domain Account T1620 Reflective Code Loading T1134.001 Token Impersonation/Theft T1553.002 Code Signing T1021.003 Distributed Component Object Model T1543.003 Windows Service T1027.002 Software Packing T1497.001 System Checks T1569.002 Service Execution T1036 Masquerading T1021.002 SMB/Windows Admin Shares T1053.005 Scheduled Task T1090 Proxy T1550 Use Alternate Authentication Material T1547.009 Shortcut Modification T1555 Credentials from Password Stores T1588.002 Tool T1047 Windows Management Instrumentation T1046 Network Service Discovery T1055 Process Injection T1059.001 PowerShell T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter T1210 Exploitation of Remote Services T1550.002 Pass the Hash T1560 Archive Collected Data T1548.002 Bypass User Account Control T1110 Brute Force T1068 Exploitation for Privilege Escalation T1552.004 Private Keys T1003 OS Credential Dumping T1087 Account Discovery T1546.003 Windows Management Instrumentation Event Subscription T1090.001 Internal Proxy T1007 System Service Discovery T1552.001 Credentials In Files T1204.003 Malicious Image T1040 Network Sniffing
Reporting
Research mentioning PoshC2
Aug 3
Securelist
Incident response statistics and cases at educational institutions in Brazil | Securelist
Brazilian educational institutions faced a sustained wave of cyber incidents in incident-response cases reviewed from January 2025 through June 2026, with attackers most often gaining access through valid accounts, exploitation of public-facing applications, insider activity, and weak patch management. High-severity cases were dominated by ransomware, particularly DragonForce and LockBit 3, and private institutions were more frequently affected than public ones. Investigators also found that outdated and unpatched systems, including Windows 10 deployments kept past end of support and unpatched Windows Server 2016 hosts, materially increased exposure. Representative intrusions showed attackers relying on common but effective techniques rather than novel tradecraft. One LockBit case involved a custom deployment built from the leaked builder and spread with PsExec, aligning with the well-documented abuse of Windows service execution for lateral movement and payload launch. Another DragonForce intrusion used AnyDesk and log wiping to maintain access and hinder response, while a separate insider case involved a Python keylogger installed on a shared machine to capture credentials. The findings underscore the need for MFA, least privilege, removal of shared accounts, tighter control of remote-access tools, stronger backups, centralized logging, longer EDR retention, and faster patching.
Mar 9
Mitre Attack Website
