NETRESEC

No entries match these filters. Clear filters

1. docs update Oct 20, 2026 · issue 114

   CapLoader 2.2 adds abuse-risk alerts for services/infrastructure, improved flow transcript navigation, and smarter BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. filter feedback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds built-in detections for services and infrastructure that may be abused, expanding CapLoader's alerting engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves flow transcripts to be easier to navigate.
   • Improves alert-based coloring for traffic visualization.
   • Adds more helpful BPF filter feedback to guide filter authoring.
   • Adds built-in detections for services and infrastructure that may be abused, expanding CapLoader's alerting engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

2. docs update Oct 20, 2026 · issue 114

   CapLoader 2.2 adds keyboard transcript navigation with pre-fetching, an AlertSeverity color scheme, and improved BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. filter error feedback.

   • Adds AlertSeverity row color scheme, coloring each flow, service, and host by its highest-severity alert.
   • Enables keyboard arrow-key navigation between flow transcripts, with pre-fetching of the next Flow Index to reduce latency.
   • Pressing Enter from any tab opens the transcript for the selected flow (or multiple transcripts when multiple flows are selected).
   • BPF filter boxes now show color-coded error checking and tooltips to warn about possible syntax mistakes.

   4 details in Everything

   • New detection Abuse-oriented infrastructure detections
   • New integration External blocklist support from IFIN, GAYINT, and Spamhaus
3. docs update Oct 20, 2026 · issue 114

   CapLoader 2.2 improves flow transcript navigation, alert-based coloring, and BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. filter feedback.

   • Improves flow transcript navigation to make it easier to move through captured sessions.
   • Improves alert-based coloring for clearer visual triage of flagged traffic.
   • Provides more helpful feedback on BPF filter expressions.

   3 details in Everything

   • New detection Alerts for services and infrastructure that may be abused
4. CapLoader 2.2 Released (2026-10-19) Oct 19, 2026 · issue 114

   CapLoader 2.2 adds an AlertSeverity color scheme, arrow-key transcript navigation with pre-fetching, Enter-to-open-transcript from any tab, and BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. filter color/tooltip error feedback.

   • Adds the AlertSeverity row color scheme, coloring each flow, service, and host by the highest-severity alert associated with it.
   • Enables keyboard navigation between flow transcripts using the arrow keys, with pre-fetching of the next Flow Index for faster loading.
   • Pressing Enter on any tab now opens the transcript for the selected flow(s), not only from the Flows tab.
   • Adds color and tooltip feedback in BPF filter boxes to warn about possible syntax mistakes.

   4 details in Everything

   • New detection Abuse-focused infrastructure alert detections
   • New integration External blocklist support
5. changelog Oct 13, 2026 · issue 107

   NETRESEC publishes SuricataSuricataAn open-source network threat detection engine maintained by the OISF that performs IDS, IPS, and network security monitoring; cyber tools build on it for high-speed packet inspection and rule-based alerting. rules and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. for AtlasRAT C2 detection across SFuck, BFuck, TLS, and fake-cert variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Suricata rule sid:1471105 to detect AtlasRAT loader SFuck C2 check-in (|53 46 75 63 6b 00 00 00| on tcp-pkt).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Suricata rule sid:1471106 to detect AtlasRAT loader BFuck C2 check-in (|42 46 75 63 6b 00 00 00| on tcp-pkt).
   • Adds Suricata rule sid:1471107 to detect AtlasRAT TLS C2 handshake on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443.
   • Adds Suricata rule sid:1471108 to detect AtlasRAT self-signed X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate impersonating update.microsoft.com.
   • Publishes all four Suricata rules to the Netresec Suricata GitHub repo at https://github.com/Netresec/Suricata.

   +2 more show less

   • Documents AtlasRAT JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port./JA3S fingerprints (e26606c572e55d499b0676e9095e3df8 / f98a4985f829b6513fbeccf5b751b458) and certificate thumbprint (a66308a1fb09c8345228ca00335e633b2dabde53) as actionable IOCs.
   • FlowCarp detection model for win.atlas_rat updated to cover both the older SFuck and newer BFuck C2 protocol variants.
   • Adds Suricata rule sid:1471105 to detect AtlasRAT loader SFuck C2 check-in (|53 46 75 63 6b 00 00 00| on tcp-pkt).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Suricata rule sid:1471106 to detect AtlasRAT loader BFuck C2 check-in (|42 46 75 63 6b 00 00 00| on tcp-pkt).
   • Adds Suricata rule sid:1471107 to detect AtlasRAT TLS C2 handshake on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443.
   • Adds Suricata rule sid:1471108 to detect AtlasRAT self-signed X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate impersonating update.microsoft.com.
   • Publishes all four Suricata rules to the Netresec Suricata GitHub repo at https://github.com/Netresec/Suricata.

   +1 more show less

   • Documents AtlasRAT JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port./JA3S fingerprints (e26606c572e55d499b0676e9095e3df8 / f98a4985f829b6513fbeccf5b751b458) and certificate thumbprint (a66308a1fb09c8345228ca00335e633b2dabde53) as actionable IOCs.

   1 more in Everything

6. docs update Oct 12, 2026 · issue 105
   • Updated detection AtlasRAT C2 detection
7. Detecting AtlasRAT C2 (2026-10-12) Oct 12, 2026 · issue 105
   • New detection Atlas RAT BFuck C2 check-in detection (Suricata)
   • New detection Atlas RAT SFuck C2 check-in detection (Suricata)
   • New detection Atlas RAT TLS handshake detection (Suricata)
   • New detection Atlas RAT fake Microsoft X.509 certificate detection (Suricata)
   • Updated detection FlowCarp Atlas RAT detection model updated to cover BFuck variant and TLS C2
8. docs update Oct 8, 2026 · issue 097

   NetworkMiner 3.2 adds RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. parsing and expands UMASUMASA proprietary industrial protocol developed by Schneider Electric for communication with Modicon PLCs, giving cyber tools a way to read and write controller memory, configuration, and runtime data. and IEC-104IEC-104A SCADA communication protocol standardized by the IEC for transmitting telecontrol data over TCP/IP networks, commonly used in power grid infrastructure; cyber tools target it to monitor or test industrial control system traffic. OT protocol support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a RADIUS protocol parser that extracts usernames, passwords (encrypted or hashed), IP addresses, messages, and RADIUS-specific identifiers from captured traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds support for IEC-104 command ID 60 (C_RC_TA_1) 'Regulating step command with time tag CP56Time2a', covering increase/decrease of a data-point by one in European and Asian power grid monitoring.
   • Adds a RADIUS protocol parser that extracts usernames, passwords (encrypted or hashed), IP addresses, messages, and RADIUS-specific identifiers from captured traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

9. docs update Oct 8, 2026 · issue 097

   NetworkMiner 3.2 removes the automatic JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. database download from ja4db.com that previously ran every 30 days.

   • New detection RADIUS protocol parser
   • Updated detection UMAS parser: Read Physical Address and Write Physical Address command support
   • Updated detection IEC-104 command ID 60 (C_RC_TA_1) support
   └──▷ BREAKING ON UPGRADE

   • !NetworkMiner Professional no longer attempts to download the JA4 database from ja4db.com; the automatic 30-day update mechanism has been removed in 3.2.
10. changelog Oct 6, 2026 · issue 096

    NETRESEC launches FlowCarp, a statistical traffic-analysis engine identifying protocols — including encrypted or obfuscated C2 — without static signatures or formal specs.

    • New detectionIntroduces FlowCarp, a protocol-identification engine that detects application-layer protocols by analyzing statistical characteristics of network traffic and comparing them with models of known protocols, covering legitimate and malicious protocols including C2 traffic without requiring a formal protocol specification.
    • FlowCarp can generate alerts and integrate with existing monitoring workflows, complementing traditional IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. signatures and protocol parsers rather than replacing them.

    2 details in Everything

11. docs update Oct 6, 2026 · issue 096
    • Updated detection Emerging Threats rule 2035595 updated to distinguish PureRAT from PureLogs Stealer / zgRAT
12. docs update Oct 6, 2026 · issue 096
    • Updated detection Emerging Threats rule 2035595 updated to identify PureRAT
13. docs update Oct 6, 2026 · issue 096
    • Updated detection Emerging Threats rule 2035595 updated to identify PureRAT
14. Stop Feeding the SOC Garbage (2026-10-06) Oct 6, 2026 · issue 096

    FlowCarp adds statistical network-flow analysis to identify protocols without signatures, generating alerts that integrate with existing SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. monitoring workflows.

    • New detectionIntroduces FlowCarp, a protocol-identification engine that classifies application-layer protocols — including proprietary, encrypted, obfuscated, and C2 protocols — by analyzing statistical characteristics of network flows rather than static IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. signatures or protocol parsers.
    • FlowCarp can generate alerts and integrate with existing monitoring workflows, providing a complementary detection layer alongside traditional IDS rules and port-based detections.
    • FlowCarp protocol models can be built from example traffic captures alone, without requiring a formal protocol specification.

    3 details in Everything

15. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 updated to identify PureRAT instead of zgRAT
16. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 reclassified from zgRAT to PureRAT
17. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 updated to identify PureRAT
18. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 reclassified from zgRAT to PureRAT
19. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 reclassified from zgRAT to PureRAT
20. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 updated to identify PureRAT instead of zgRAT
21. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 updated to identify PureRAT
22. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 updated to reflect zgRAT / PureRAT / PureLogs Stealer family classification
23. docs update Oct 5, 2026 · issue 095
    • Updated detection Emerging Threats rule 2035595 updated to reflect zgRAT / PureRAT / PureLogs Stealer family classification
24. changelog Sep 26, 2026 · issue 086
    └──▷ TRY IT
    Build a custom C2 protocol model from sandbox-captured sessions so FlowCarp can recognize that malware family in future PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Classify traffic in a newly captured PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. against a previously built protocol model to identify C2 activity.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Submit a PCAP to the free demo server to quickly identify protocols and C2 families across 600+ models without a local install.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

25. changelog Sep 25, 2026 · issue 085

    FlowCarp adds statistical C2 protocol classification for PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files, with a demo API at demo.flowcarp.com supporting 600+ protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Build a custom model for a newly discovered C2 protocol using sandbox capture sessions, so FlowCarp can recognise it in future PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Classify traffic in a new sandbox PCAP against the custom model to confirm which samples use the same C2 protocol.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Submit a PCAP to the demo server for instant protocol identification across 600+ protocols without standing up a local FlowCarp instance.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

    • Adds flowcarp --input <pcap> --output model:<Label>:<MALICIOUS|BENIGN>:<file>.fcp to build a custom statistical protocol model from example traffic captures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds flowcarp --model <file>.fcp --input <pcap> --output - to classify traffic in a new PCAP against a previously built protocol model.

    2 details in Everything

26. docs update Sep 24, 2026 · issue 084

    NETRESEC: Adds --model <file>.fcp flag to flowcarp to apply a custom protocol model against a new PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for classification.

    └──▷ TRY IT
    Train a custom C2 protocol model from sandbox-captured PCAP sessions so FlowCarp can recognize a newly discovered malware family in future captures.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Apply a custom protocol model against a new PCAP to classify whether traffic matches the trained malware family.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Submit a PCAP to the free FlowCarp demo server to get instant protocol and malware family classification across 600+ known protocols during triage.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

27. docs update Sep 24, 2026 · issue 084

    NETRESEC: Assigns a single protocol or malware family label per flow, reducing the multi-alert overlap common in traditional IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity.-based C2 classification workflows.

    └──▷ TRY IT
    Build a custom statistical model for a newly discovered C2 protocol from sandbox PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. so FlowCarp can recognize it in future captures.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Validate a newly built C2 protocol model against captures from additional sandbox executions to check generalization before deploying.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

28. docs update Sep 24, 2026 · issue 084
    └──▷ TRY IT
    Build a custom detection model for a newly discovered C2 protocol from sandbox captures, then validate it against a fresh PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp
    flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Quickly triage an unknown PCAP for C2 protocol family identification using the free demo server before building a local workflow.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

29. changelog Sep 24, 2026 · issue 084

    NETRESEC: Adds --input, --output, and --model flags to the flowcarp CLI for building statistical protocol models from PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files and classifying traffic against them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Train a custom model from sandbox-captured C2 sessions so FlowCarp can recognize a new malware family in future captures.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Classify flows in a newly captured PCAP against a previously trained custom C2 protocol model.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Quickly identify protocols and C2 alerts in a PCAP using the free demo service without standing up a local FlowCarp instance.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

    • Adds flowcarp --output model:<label>:<tag>:<file>.fcp syntax to train and save a custom protocol model from example capture files, enabling detection of proprietary or novel C2 protocols without hand-written signatures.
    • Exposes a free demo web service at https://demo.flowcarp.com accepting raw PCAP uploads via curl --data-binary and returning a JSON response with detected flows, protocols, and alerts.
    • Introduces FlowCarp statistical protocol classification as a malware-family identification layer, distinguishing C2 traffic by packet sizes, timing, message-length distributions, request/response behavior, and protocol structure — covering 600+ protocols on the commercial license.

    3 details in Everything

30. changelog Sep 23, 2026 · issue 083

    NETRESEC: FlowCarp assigns a single protocol or malware family label per flow using statistical classification (packet sizes, timing, message length distributions, request/response behavior, protocol structure), reducing the multi-alert overlap common with IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. signature matching.

    └──▷ TRY IT
    Train a custom detection model from sandbox PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. captures of an unknown C2 protocol so FlowCarp can recognize it in future traffic.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Quickly identify C2 protocols in a PCAP during incident response without standing up a local FlowCarp instance.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

    Validate a newly built protocol model against captures from additional sandbox executions to confirm generalization.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

31. changelog Sep 23, 2026 · issue 083

    NETRESEC: Adds a free demo API endpoint at https://demo.flowcarp.com (via curl --data-binary @<file>.pcap) that accepts a raw PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. and returns a JSON response containing detected flows, protocols, and alerts, backed by a commercial license covering 600+ protocols.

    └──▷ TRY IT
    Train a custom C2 protocol model from sandbox PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. of a newly discovered malware family, then classify an unknown capture against it.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp
    flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Quickly triage a suspicious PCAP against 600+ known protocols via the free demo API and filter results with jq during incident response.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

32. changelog Sep 22, 2026 · issue 082

    FlowCarp adds statistical C2 protocol classification and a free demo API at demo.flowcarp.com supporting 600+ protocols⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Train a custom protocol model from sandbox C2 captures so FlowCarp can recognize a previously unknown malware family in future PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Classify traffic in a new PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. against your custom model to confirm C2 protocol matches across different samples or sandbox runs.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Submit a PCAP to the free demo server during triage to instantly identify C2 protocols across 600+ known families without a local FlowCarp install.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

33. docs update Sep 21, 2026 · issue 081
    └──▷ TRY IT
    Build a reusable detection model for a newly discovered C2 protocol from sandbox PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. captures, so FlowCarp can recognize it in future traffic without any hand-written IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. rule.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Quickly identify which malware family's C2 protocol is present in a PCAP without standing up a local instance — useful as a first triage step during incident response.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

    Validate a newly built protocol model against captures from other sandbox executions to confirm it generalises beyond the training data.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

34. docs update Sep 21, 2026 · issue 081

    NETRESEC: Supports a model:<label>:<tag>:<file>.fcp output format to create named, tagged statistical protocol models (e.g. model:MalwareXYZ:MALICIOUS:malwarexyz.fcp) from example capture files.

    └──▷ TRY IT
    Build a custom detection model for a newly discovered malware C2 protocol from sandbox PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. captures, then classify new traffic against it.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp
    flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Quickly triage a suspicious PCAP against 600+ known C2 and application protocols without a local FlowCarp install, feeding the JSON output into jq for filtering.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

    • Assigns a single protocol or malware family label per flow, reducing multi-alert overlap that occurs when generic IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. signatures match traffic from several families simultaneously.

    1 detail in Everything

35. Unmasking Malware Families (2026-09-21) Sep 21, 2026 · issue 081

    FlowCarp brings statistical C2C2Command-and-control infrastructure used by attackers to remotely direct compromised systems; cyber tools use it to simulate or detect adversary communication channels during red-team or threat-detection work. protocol classification to PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. analysis, identifying 600+ malware families without signature rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Train a custom FlowCarp model from sandbox-captured C2 sessions so you can classify unknown malware traffic without writing IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. signatures.
    copy

    $ flowcarp --input xyz.pcap --output model:MalwareXYZ:MALICIOUS:malwarexyz.fcp

    Classify traffic from a new sandbox capture against your custom protocol model to confirm C2 family attribution.
    copy

    $ flowcarp --model malwarexyz.fcp --input new.pcap --output -

    Submit a PCAP to the FlowCarp demo service and pipe the JSON results into jq for quick triage during incident response.
    copy

    $ curl --data-binary @dump.pcap https://demo.flowcarp.com | jq

    • Adds --input, --output, and --model flags to the flowcarp CLI for building and applying custom statistical protocol models from PCAP files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds flowcarp --input <pcap> --output model:<label>:<class>:<file>.fcp to train a new protocol model from example C2 capture sessions.
    • Adds flowcarp --model <file>.fcp --input <pcap> --output - to classify traffic in a new PCAP against a previously built custom model.
    • Exposes a demo REST endpoint at https://demo.flowcarp.com accepting raw PCAP via HTTP POST and returning a JSON response of detected flows, protocols, and alerts.
    • Introduces FlowCarp, a statistical application-layer protocol classifier that identifies C2 protocols — including encrypted and proprietary ones — by analyzing packet sizes, timing, message length distributions, and request/response behavior rather than byte-sequence signatures.

    +1 more show less

    • Supports detection of more than 600 protocols on the hosted demo service, with the ability to add custom protocol models from user-supplied example traffic.

    6 details in Everything

36. docs update Sep 15, 2026 · issue 075

    PolarProxy 2.0.2 adds Tor proxy support, idle timeout controls, SOCKS4/5SOCKS4/5A proxy protocol that relays TCP connections (and UDP in version 5) through an intermediary host, letting cyber tools tunnel traffic through firewalls or pivot points without needing IP-level routing. relay, license key file, and --helpenv for environment variable discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Terminate hung sessions automatically to prevent resource exhaustion in long-running proxy deployments.
    copy

    $ polarproxy --idletimeoutclient 60 --idletimeoutserver 120

    Discover which environment variables can replace command-line arguments, useful for container and CI deployments where flags are passed via env.
    copy

    $ polarproxy --helpenv

    • Adds --connect socks4:HOST:PORT and --connect socks5:HOST:PORT options to relay outgoing sessions through a SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, enabling traffic forwarding via Tor or other SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. intermediaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --keyfile <path> flag to load a license key from a file path, enabling higher data/session limits.
    • Adds --helpenv flag to print all environment variables that can substitute command-line arguments.
    • Adds --debug flag to print debug information to STDERR, overriding -v.
    • Adds Tor proxy mode, running PolarProxy as a local SOCKS and/or HTTP proxy that relays connections to Tor, with TLS decryption/re-encryption unless --bypass is used.

    +4 more show less

    • Adds HTTP proxy mode where TLS traffic is decrypted and re-encrypted regardless of port.
    • Adds allow as a --bypass action to let connections pass through without decryption when the target host is provided explicitly (via --httpconnect, --socks, or --haproxy).
    • Publishes container image at ghcr.io/netresec/polarproxy with deployment instructions and configs at https://github.com/Netresec/PolarProxy.
    • Adds Linux ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build and a release manifest with fixed version-specific download URLs and hashes.
    • Adds --connect socks4:HOST:PORT and --connect socks5:HOST:PORT options to relay outgoing sessions through a SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, enabling traffic forwarding via Tor or other SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. intermediaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --keyfile <path> flag to load a license key from a file path, enabling higher data/session limits.
    • Adds --helpenv flag to print all environment variables that can substitute command-line arguments.
    • Adds Tor proxy mode, running PolarProxy as a local SOCKS and/or HTTP proxy that relays connections to Tor, with TLS decryption/re-encryption unless --bypass is used.
    • Adds HTTP proxy mode where TLS traffic is decrypted and re-encrypted regardless of port.

    +3 more show less

    • Adds allow as a --bypass action to let connections pass through without decryption when the target host is provided explicitly (via --httpconnect, --socks, or --haproxy).
    • Publishes container image at ghcr.io/netresec/polarproxy with deployment instructions and configs at https://github.com/Netresec/PolarProxy.
    • Adds Linux ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build and a release manifest with fixed version-specific download URLs and hashes.

    1 more in Everything

37. changelog Sep 14, 2026 · issue 074
    └──▷ TRY IT
    Inspect and capture your own HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before it enters Tor — useful for auditing what a tool actually sends over the anonymisation network.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Prevent zombie connections in long-running deployments by dropping clients and servers that go silent for more than two minutes.
    copy

    $ PolarProxy --socks 1080 --idletimeoutclient 120 --idletimeoutserver 120 --tlstimeout 30

38. changelog Sep 13, 2026 · issue 073

    NETRESEC: Adds outbound SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy client via --connect socks5:<host>:<port> (or socks4:), supporting both SOCKS4 and SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead., enabling use cases such as routing inspected TLS traffic through Tor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Intercept and decrypt HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before it exits through the Tor network, capturing all proxied traffic (including non-TLS) to a PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-over-IP stream for live analysis.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Kill lingering zombie connections in long-running proxy sessions by enforcing idle timeouts on both sides of the connection.
    copy

    $ PolarProxy --socks 1080 --timeout 30 --tlstimeout 30 --idletimeoutclient 120 --idletimeoutserver 120

    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client and server sides respectively.
    • Adds --tlstimeout <seconds> flag to enforce a timeout on the TLS handshake stage (default 30 seconds).
    • Adds --timeout <seconds> flag to enforce a timeout on the TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake stage (default 30 seconds).
    • Supports environment variables as an alternative to command-line arguments, using uppercase names with the PP_ prefix (e.g., PP_SOCKS maps to --socks).
    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client and server sides respectively.
    • Adds --tlstimeout <seconds> flag to enforce a timeout on the TLS handshake stage (default 30 seconds).
    • Supports environment variables as an alternative to command-line arguments, using uppercase names with the PP_ prefix (e.g., PP_SOCKS maps to --socks).

    1 more in Everything

39. changelog Sep 12, 2026 · issue 072

    PolarProxy 2.0.2 adds outgoing SOCKS4/5SOCKS4/5A proxy protocol that relays TCP connections (and UDP in version 5) through an intermediary host, letting cyber tools tunnel traffic through firewalls or pivot points without needing IP-level routing. tunneling, environment-variable config, idle-connection timeouts, and an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Intercept and decrypt your own HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before it exits through Tor — useful for auditing what an application actually sends over an anonymizing network.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Kill stalled client and server connections after two minutes of inactivity to prevent zombie sessions from accumulating in long-running deployments.
    copy

    $ PolarProxy --socks 1080 --idletimeoutclient 120 --idletimeoutserver 120 --tlstimeout 30

    • Adds --connect socks5:<host>:<port> (and socks4) to route PolarProxy's outgoing connections through an upstream SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, enabling use cases such as inspecting HTTPS traffic before forwarding it through Tor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle (dead) connections after a configurable period; complements the existing --timeout <seconds> (TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake) and new --tlstimeout <seconds> (TLS handshake) flags.
    • Adds --tlstimeout <seconds> for a dedicated TLS-handshake timeout, separate from the existing TCP-handshake --timeout; default is 30 seconds.
    • Adds --writeall flag to extend PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-over-IP output to include all proxied traffic, not only decrypted TLS sessions.
    • Adds --helpenv flag to print a full list of supported environment variables.

    +3 more show less

    • Supports environment variables as an alternative to command-line arguments; variables use the PP_ prefix (e.g., PP_SOCKS maps to --socks), enabling clean config separation for systemd, Docker, Podman, Kubernetes, and Helm deployments via a polarproxy.env file.
    • Ships with a software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM) in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format as polarproxy.spdx.json, covering all components, libraries, and dependencies for supply-chain transparency and vulnerability scanning integration.
    • Bundles a docker-compose.yml (musl builds) or a systemd unit file with install-polarproxy-service.sh (non-musl Linux builds) to simplify initial deployment.

    8 details in Everything

40. docs update Sep 9, 2026 · issue 069

    NETRESEC: Adds --connect socks5:<host>:<port> (and socks4) to route PolarProxy's outgoing connections through an upstream SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, enabling use cases such as TLS inspection before forwarding traffic through Tor.

    └──▷ TRY IT
    Inspect your own HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before it enters the Tor network — decrypt TLS at PolarProxy and capture everything (including non-TLS) to a PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-over-IP stream for live analysis.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Kill idle upstream connections after 120 s and enforce a 10 s TLS-handshake deadline to avoid zombie sessions accumulating in long-running proxy deployments.
    copy

    $ PolarProxy --socks 1080 --tlstimeout 10 --idletimeoutserver 120 --idletimeoutclient 120

    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close connections idle beyond the specified period, preventing zombie connections.
    • Adds --tlstimeout <seconds> flag for a dedicated TLS-handshake timeout (default 30 s), separate from the existing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-handshake --timeout <seconds>.
    • Supports PP_-prefixed uppercase environment variables as an alternative to all command-line arguments, suitable for systemd, Docker, Podman, Kubernetes, and Helm deployments.
    • Includes a software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format (polarproxy.spdx.json) for supply-chain transparency and vulnerability-scanner integration.

    4 details in Everything

41. docs update Sep 9, 2026 · issue 069

    NETRESEC: Adds --bypass switch to use PolarProxy purely as a protocol converter without decrypting or re-encrypting TLS.

    └──▷ TRY IT
    Inspect your own HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before it enters the Tor network, with full PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capture of all tunneled traffic including non-TLS flows.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Drop zombie connections that have been idle to prevent resource exhaustion in long-running proxy deployments.
    copy

    $ PolarProxy --socks 1080 --idletimeoutclient 120 --idletimeoutserver 300

    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client and server sides respectively; idle timeout is disabled by default.
    • Adds --tlstimeout <seconds> flag to close connections that stall during the TLS handshake (existing --timeout covers the TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake; default is 30 seconds for both).
    • Supports environment variables as an alternative to command-line arguments; variables use uppercase names with the PP_ prefix (e.g., PP_SOCKS corresponds to --socks); run --helpenv to list all supported variables.
    • Includes an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format, shipped as polarproxy.spdx.json, for software supply chainsoftware supply chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it. transparency and integration with vulnerability scanning tools.

    4 details in Everything

42. docs update Sep 9, 2026 · issue 069

    PolarProxy gains Tor proxy mode, idle timeout controls, SOCKS4/5SOCKS4/5A proxy protocol that relays TCP connections (and UDP in version 5) through an intermediary host, letting cyber tools tunnel traffic through firewalls or pivot points without needing IP-level routing. connect chaining, and license key file support.

    └──▷ TRY IT
    Kill stalled sessions automatically so long-running transparent proxy deployments do not accumulate zombie connections.
    copy

    $ polarproxy --idletimeoutclient 60 --idletimeoutserver 120

    Load a license key from disk to unlock higher session/data limits without embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the key in a shell history or process list.
    copy

    $ polarproxy --keyfile /etc/polarproxy/license.key

    • Adds Tor proxy mode: PolarProxy can now run as a local SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. and/or HTTP proxy, relaying connections to Tor via --connect socks5:127.0.0.1:9050, with TLS decryption/re-encryption applied unless --bypass is used.
    • Adds --connect flag supporting socks4:HOST:PORT and socks5:HOST:PORT targets to chain outgoing sessions through an upstream SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, or a plain HOST sinkhole.
    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to terminate sessions idle beyond a configurable threshold (default: no timeout).
    • Adds --keyfile <path> flag to load a license key from a file, enabling higher data/session limits.
    • Adds --helpenv flag to print all environment variables that can substitute command-line arguments.

    +4 more show less

    • Adds --debug flag to print debug output to STDERR, overriding -v.
    • Adds Linux ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build and a release manifest with fixed version-specific download URLs and hashes for Linux builds.
    • Publishes official container images at ghcr.io/netresec/polarproxy with deployment instructions at https://github.com/Netresec/PolarProxy.
    • HTTP proxy mode now decrypts and re-encrypts TLS traffic regardless of port.
    • Adds Tor proxy mode: PolarProxy can now run as a local SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. and/or HTTP proxy, relaying connections to Tor via --connect socks5:127.0.0.1:9050, with TLS decryption/re-encryption applied unless --bypass is used.
    • Adds --connect flag supporting socks4:HOST:PORT and socks5:HOST:PORT targets to chain outgoing sessions through an upstream SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy, or a plain HOST sinkhole.
    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to terminate sessions idle beyond a configurable threshold (default: no timeout).
    • Adds --keyfile <path> flag to load a license key from a file, enabling higher data/session limits.
    • Adds --helpenv flag to print all environment variables that can substitute command-line arguments.

    +3 more show less

    • Adds --debug flag to print debug output to STDERR, overriding -v.
    • Adds Linux ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build and a release manifest with fixed version-specific download URLs and hashes for Linux builds.
    • Publishes official container images at ghcr.io/netresec/polarproxy with deployment instructions at https://github.com/Netresec/PolarProxy.

    1 more in Everything

43. docs update Sep 9, 2026 · issue 069

    NETRESEC: Adds --helpenv flag to print all supported environment variables, and introduces the PP_ prefix convention (e.g. PP_SOCKS mirrors --socks) so PolarProxy can be fully configured without command-line arguments — suited for Docker, Kubernetes, Helm, systemd, and Podman deployments.

    └──▷ TRY IT
    Intercept and decrypt your own HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before it enters the Tor network — capture everything, including non-TLS flows, via PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-over-IP for live analysis.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Run PolarProxy in a container-friendly way using a polarproxy.env file instead of baking secrets and flags into the command line.
    polarproxy.env copy

    # polarproxy.env
    PP_SOCKS=1080
    PP_PCAPOVERIP=57012
    PP_IDLETIMEOUTCLIENT=120
    PP_IDLETIMEOUTSERVER=120

    Discover every environment variable PolarProxy supports before writing your deployment config.
    copy

    $ PolarProxy --helpenv

    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections, complementing the existing --timeout <seconds> (TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake) and --tlstimeout <seconds> (TLS handshake) options.
    • Ships a software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format as polarproxy.spdx.json, enabling integration with vulnerability scanning and supply-chain compliance workflows.

    2 details in Everything

44. docs update Sep 9, 2026 · issue 069

    NETRESEC: Ships a software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) with PolarProxy.

45. PolarProxy 2.0.2 Released (2026-09-08) Sep 8, 2026 · issue 069

    PolarProxy 2.0.2 adds SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. client tunneling, environment-variable config, idle connection timeouts, and an SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    └──▷ TRY IT
    Intercept and decrypt HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic before forwarding it through Tor, with full PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capture of all tunneled traffic for offline analysis.
    copy

    $ PolarProxy --socks 1080 --connect socks5:127.0.0.1:9050 --nontls allow --pcapoverip 57012 --writeall

    Run PolarProxy in Docker with idle-timeout and SOCKS settings supplied via environment variables instead of command-line flags, keeping secrets out of process arguments.
    polarproxy.env copy

    PP_SOCKS=1080
    PP_CONNECT=socks5:127.0.0.1:9050
    PP_IDLETIMEOUTCLIENT=120
    PP_IDLETIMEOUTSERVER=120
    PP_NONTLS=allow

    Quickly audit which environment variables PolarProxy accepts before migrating from CLI flags to a container-friendly env-var config.
    copy

    $ PolarProxy --helpenv

    • Adds --connect socks5:<host>:<port> (and socks4) to tunnel outgoing connections through an upstream SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy server, enabling use cases such as routing decrypted TLS inspection traffic through Tor.
    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client or server side; complements existing --timeout <seconds> (TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake) and --tlstimeout <seconds> (TLS handshake) flags.
    • Adds --writeall flag to extend PCAP-over-IP output to include all proxied traffic, not just decrypted TLS.
    • Adds --helpenv flag to print all supported environment variables.
    • Supports environment variables with the PP_ prefix (e.g. PP_SOCKS maps to --socks) as an alternative to command-line arguments, enabling clean config/app separation for systemd, Docker, Podman, Kubernetes, and Helm deployments.

    +2 more show less

    • Ships a polarproxy.spdx.json SBOM in SPDX format, listing all components, libraries, and dependencies for supply-chain transparency and vulnerability-scanner integration.
    • Ships a docker-compose.yml (musl builds) or systemd unit file with install-polarproxy-service.sh (non-musl Linux builds) to simplify deployment alongside a polarproxy.env configuration file.
    • Adds --connect socks5:<host>:<port> (and socks4) to tunnel outgoing connections through an upstream SOCKS4 or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy server, enabling use cases such as routing decrypted TLS inspection traffic through Tor.
    • Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client or server side; complements existing --timeout <seconds> (TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake) and --tlstimeout <seconds> (TLS handshake) flags.
    • Adds --helpenv flag to print all supported environment variables.
    • Supports environment variables with the PP_ prefix (e.g. PP_SOCKS maps to --socks) as an alternative to command-line arguments, enabling clean config/app separation for systemd, Docker, Podman, Kubernetes, and Helm deployments.
    • Ships a polarproxy.spdx.json SBOM in SPDX format, listing all components, libraries, and dependencies for supply-chain transparency and vulnerability-scanner integration.

    +1 more show less

    • Ships a docker-compose.yml (musl builds) or systemd unit file with install-polarproxy-service.sh (non-musl Linux builds) to simplify deployment alongside a polarproxy.env configuration file.

    1 more in Everything

46. docs update Aug 22, 2026 · issue 053

    FlowCarp gains detection for CNCMachineRMS RAT C2 protocol, with a free demo endpoint for PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. submission

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Test a suspicious PCAP for CNCMachineRMS C2 traffic using the free FlowCarp demo server — useful for quick triage without deploying local tooling.
    copy

    $ curl --data-binary @suspicious.pcap https://demo.flowcarp.com

    • Adds detection model for the CNCMachineRMS RAT binary C2 protocol to FlowCarp, enabling identification of sessions on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 that mimic HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. but are unencrypted.
    • Exposes https://demo.flowcarp.com as a free public endpoint: submit a PCAP via curl --data-binary and receive a JSON alert if CNCMachineRMS traffic is present.
    • Documents CNCMachineRMS's use of DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.) to bypass local DNS logging, with lookups sent to dns.google, cloudflare-dns.com, and dns.quad9.net before C2 connection.
    • Publishes IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. including four C2 server IPs on port 443, two C2 domains (notepadreleased[.]com, triotmelon[.]com), and four file hashes for known CNCMachineRMS samples.

    4 details in Everything

47. CNCMachineRMS C2 Protocol (2026-08-21) Aug 21, 2026 · issue 053

    NETRESEC adds CNCMachineRMS C2 protocol detection to FlowCarp, with a free PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. submission API for instant triage.

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Quickly triage a suspicious PCAP from an incident or sandbox run to check for CNCMachineRMS C2 traffic without standing up any local tooling.
    copy

    $ curl --data-binary @suspicious.pcap https://demo.flowcarp.com

    • Adds a statistical detection model for the CNCMachineRMS binary C2 protocol to FlowCarp, enabling identification of this RAT's traffic on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 without TLS decryption.
    • Exposes the FlowCarp demo server at https://demo.flowcarp.com accepting raw PCAP uploads via curl --data-binary and returning JSON alerts when CNCMachineRMS traffic is detected.
    • Documents four confirmed CNCMachineRMS C2 server IPs — 89.110.110.119:443, 85.158.110.78:443, 89.124.79.98:443, 144.124.242.171:443 — and two associated domains (notepadreleased[.]com, triotmelon[.]com) as actionable network IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
    • Documents the malware's DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. evasion technique — queries routed to dns.google, cloudflare-dns.com, and dns.quad9.net over TLS — so defenders know local DNS logs will not capture the C2 domain lookup and should alert on DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. connections preceding port 443 C2 activity.

    4 details in Everything

48. 2.0.1 Jun 5, 2026 · release notes

    PolarProxy 2.0.1 prioritizes accurate PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. output over throughput and reduces memory overhead.

    • Prioritizes accurate PCAP output by rate-limiting proxied traffic if the real-time PCAP-over-IP consumer falls behind, preserving every decrypted packet for forensic analysis
    • Reduces CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory use by caching less data through a major overhaul of the data-flow logic to support more simultaneous sessions

    2 details in Everything