When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
Summary: Unit 42 found a Brute Ratel C4 sample uploaded to VirusTotal on May 19 that received a benign verdict from all 56 vendors, packaged as a self-contained ISO containing a Windows LNK file, a malicious DLL and a legitimate Microsoft OneDrive Updater copy. Pivoting on the C2 certificate, which impersonated Microsoft with organization unit "Security" and called home to an AWS IP over port 443, Unit 42 identified 41 malicious IP addresses, nine BRc4 samples and three additional organizations across North and South America affected.
Why it matters: A red-teaming tool built after reverse engineering top-tier EDR and antivirus DLLs drew zero detections from 56 vendors, and its users are now applying APT29-style packaging to deploy it - so a clean scan result is no longer evidence that a file is safe.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026