Net Wire and MITRE Chop Shop
Summary: On August 4, Unit 42, the Palo Alto Networks threat intelligence team, released a version of its NetWire RAT decryption tool that runs inside MITRE's open source ChopShop protocol analysis framework, available from the Unit 42 GitHub public_tools repo and invoked with the -M flag. The tool decrypts NetWire (NetWiredRC family) traffic, and the sample output shows decoded commands including 05 (set password, identifier and fetch computer information), 41 (fetch and send Outlook and Thunderbird credentials and certificates), and 3d (fetch stored credentials, history and certificates from common browsers).
Why it matters: The decoded session shows a compromised host at 192.168.180.80 sending its Administrator username, computer name and Windows version to 69.65.7.136 on port 2930, then issuing commands to harvest mail and browser credentials - the kind of traffic that looks like noise until someone decrypts it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026