Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool

Summary: Unit 42's Advanced WildFire memory scanning tools found a new post-exploitation red team tool, named Splinter after its internal project name left in a debug artifact, on a customer system, and sample telemetry showed several customers were affected. Splinter is written in Rust, ships as a roughly 7 MB implant or DLL that connects to its C2 server over HTTPS, pulls tasks from a JSON ImplantConfig, and offers process injection and file transfer, though Unit 42 has not tied it to any threat actor activity.

Key Takeaway: A tool Unit 42 describes as not as advanced as Cobalt Strike was still found sitting on multiple customer systems, and the researchers note criminals tend to adopt any technique that works.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026