https://cybertoolchain.io/tools/netresec New releases and features in NETRESEC, tracked by The Cyber Toolchain. en Mon, 19 Oct 2026 08:48:00 GMT https://www.netresec.com/?page=Blog&month=2026-10&post=CapLoader-2-2-Released https://www.netresec.com/?page=Blog&month=2026-10&post=CapLoader-2-2-Released Mon, 19 Oct 2026 08:48:00 GMT CapLoader 2.2 adds abuse-detection alerts for IPFS, VPNs, and blocklists, plus AlertSeverity row coloring and transcript keyboard navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `AlertSeverity` row color scheme, coloring each flow, service, and host by the highest-severity alert associated with it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands built-in detections to cover IPFS services and gateways, port forwarding services, abused web hosting and cloud storage, VPN/proxy/tunnel protocols, blockchain RPC nodes, paste bin domains, and bulletproof/scanner/VPN ASNs. • Adds support for external blocklists from IFIN, GAYINT, and Spamhaus as alert sources. • Enables keyboard navigation between flow transcripts using the arrow keys, with pre-fetching of the next Flow Index for faster loading. • Pressing Enter on any tab now opens the transcript for the selected flow(s), not only from the Flows tab. • Adds color and tooltip feedback in BPF filter boxes to warn about possible syntax mistakes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Tue, 13 Oct 2026 13:46:42 GMT NETRESEC publishes Suricata rules and IOCs for AtlasRAT C2 detection across SFuck, BFuck, TLS, and fake-cert variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Suricata rule `sid:1471105` to detect AtlasRAT loader 'SFuck' C2 check-in (`|53 46 75 63 6b 00 00 00|` on `tcp-pkt`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Suricata rule `sid:1471106` to detect AtlasRAT loader 'BFuck' C2 check-in (`|42 46 75 63 6b 00 00 00|` on `tcp-pkt`). • Adds Suricata rule `sid:1471107` to detect AtlasRAT TLS C2 handshake on TCP port 443. • Adds Suricata rule `sid:1471108` to detect AtlasRAT self-signed X.509 certificate impersonating `update.microsoft.com`. • Publishes all four Suricata rules to the Netresec Suricata GitHub repo at `https://github.com/Netresec/Suricata`. • Documents AtlasRAT JA3/JA3S fingerprints (`e26606c572e55d499b0676e9095e3df8` / `f98a4985f829b6513fbeccf5b751b458`) and certificate thumbprint (`a66308a1fb09c8345228ca00335e633b2dabde53`) as actionable IOCs. • FlowCarp detection model for `win.atlas_rat` updated to cover both the older 'SFuck' and newer 'BFuck' C2 protocol variants. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog&month=2026-10&post=Detecting-AtlasRAT-C2 https://www.netresec.com/?page=Blog&month=2026-10&post=Detecting-AtlasRAT-C2 Mon, 12 Oct 2026 14:30:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Tue, 06 Oct 2026 10:56:23 GMT NETRESEC: FlowCarp can generate alerts and integrate with existing monitoring workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog&month=2026-10&post=Stop-Feeding-the-SOC-Garbage https://www.netresec.com/?page=Blog&month=2026-10&post=Stop-Feeding-the-SOC-Garbage Tue, 06 Oct 2026 06:30:00 GMT NETRESEC introduces FlowCarp, a statistical traffic-analysis engine that identifies application-layer protocols without signatures or formal specs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces FlowCarp, a protocol-identification engine that classifies application-layer protocols — including proprietary, encrypted, obfuscated, and C2 protocols — by analyzing statistical characteristics of network flows rather than static IDS signatures or protocol parsers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • FlowCarp can generate alerts and integrate with existing monitoring workflows, providing a complementary detection layer alongside traditional IDS rules and port-based detections. • FlowCarp protocol models can be built from example traffic captures alone, without requiring a formal protocol specification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Sat, 26 Sep 2026 07:48:45 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Fri, 25 Sep 2026 07:51:48 GMT FlowCarp adds statistical C2 protocol classification for PCAP files, with a demo API at demo.flowcarp.com supporting 600+ protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `flowcarp --input <pcap> --output model:<Label>:<MALICIOUS|BENIGN>:<file>.fcp` to build a custom statistical protocol model from example traffic captures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `flowcarp --model <file>.fcp --input <pcap> --output -` to classify traffic in a new PCAP against a previously built protocol model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Thu, 24 Sep 2026 07:52:28 GMT NETRESEC: Adds `--input`, `--output`, and `--model` flags to the `flowcarp` CLI for building statistical protocol models from PCAP files and classifying traffic against them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `flowcarp --output model:<label>:<tag>:<file>.fcp` syntax to train and save a custom protocol model from example capture files, enabling detection of proprietary or novel C2 protocols without hand-written signatures. • Exposes a free demo web service at `https://demo.flowcarp.com` accepting raw PCAP uploads via `curl --data-binary` and returning a JSON response with detected flows, protocols, and alerts. • Introduces FlowCarp statistical protocol classification as a malware-family identification layer, distinguishing C2 traffic by packet sizes, timing, message-length distributions, request/response behavior, and protocol structure — covering 600+ protocols on the commercial license. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Wed, 23 Sep 2026 13:13:18 GMT NETRESEC: FlowCarp assigns a single protocol or malware family label per flow using statistical classification (packet sizes, timing, message length distributions, request/response behavior, protocol structure), reducing the multi-alert overlap common with IDS signature matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Wed, 23 Sep 2026 07:44:00 GMT NETRESEC: Adds a free demo API endpoint at `https://demo.flowcarp.com` (via `curl --data-binary @<file>.pcap`) that accepts a raw PCAP and returns a JSON response containing detected flows, protocols, and alerts, backed by a commercial license covering 600+ protocols. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Tue, 22 Sep 2026 07:45:01 GMT FlowCarp adds statistical C2 protocol classification and a free demo API at demo.flowcarp.com supporting 600+ protocols⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog&month=2026-09&post=Unmasking-Malware-Families https://www.netresec.com/?page=Blog&month=2026-09&post=Unmasking-Malware-Families Mon, 21 Sep 2026 10:00:00 GMT FlowCarp brings statistical C2 protocol classification to PCAP analysis, identifying 600+ malware families without signature rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--input`, `--output`, and `--model` flags to the `flowcarp` CLI for building and applying custom statistical protocol models from PCAP files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `flowcarp --input <pcap> --output model:<label>:<class>:<file>.fcp` to train a new protocol model from example C2 capture sessions. • Adds `flowcarp --model <file>.fcp --input <pcap> --output -` to classify traffic in a new PCAP against a previously built custom model. • Exposes a demo REST endpoint at `https://demo.flowcarp.com` accepting raw PCAP via HTTP POST and returning a JSON response of detected flows, protocols, and alerts. • Introduces FlowCarp, a statistical application-layer protocol classifier that identifies C2 protocols — including encrypted and proprietary ones — by analyzing packet sizes, timing, message length distributions, and request/response behavior rather than byte-sequence signatures. • Supports detection of more than 600 protocols on the hosted demo service, with the ability to add custom protocol models from user-supplied example traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Mon, 14 Sep 2026 07:43:32 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Sun, 13 Sep 2026 07:42:37 GMT NETRESEC: Adds outbound SOCKS proxy client via `--connect socks5:<host>:<port>` (or `socks4:`), supporting both SOCKS4 and SOCKS5, enabling use cases such as routing inspected TLS traffic through Tor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--idletimeoutclient <seconds>` and `--idletimeoutserver <seconds>` flags to close idle 'dead' connections on the client and server sides respectively. • Adds `--tlstimeout <seconds>` flag to enforce a timeout on the TLS handshake stage (default 30 seconds). • Adds `--timeout <seconds>` flag to enforce a timeout on the TCP handshake stage (default 30 seconds). • Supports environment variables as an alternative to command-line arguments, using uppercase names with the `PP_` prefix (e.g., `PP_SOCKS` maps to `--socks`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Sat, 12 Sep 2026 10:44:05 GMT PolarProxy 2.0.2 adds outgoing SOCKS4/5 tunneling, environment-variable config, idle-connection timeouts, and an SBOM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--connect socks5:<host>:<port>` (and `socks4`) to route PolarProxy's outgoing connections through an upstream SOCKS4 or SOCKS5 proxy, enabling use cases such as inspecting HTTPS traffic before forwarding it through Tor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--idletimeoutclient <seconds>` and `--idletimeoutserver <seconds>` flags to close idle ('dead') connections after a configurable period; complements the existing `--timeout <seconds>` (TCP handshake) and new `--tlstimeout <seconds>` (TLS handshake) flags. • Adds `--tlstimeout <seconds>` for a dedicated TLS-handshake timeout, separate from the existing TCP-handshake `--timeout`; default is 30 seconds. • Adds `--writeall` flag to extend PCAP-over-IP output to include all proxied traffic, not only decrypted TLS sessions. • Adds `--helpenv` flag to print a full list of supported environment variables. • Supports environment variables as an alternative to command-line arguments; variables use the `PP_` prefix (e.g., `PP_SOCKS` maps to `--socks`), enabling clean config separation for systemd, Docker, Podman, Kubernetes, and Helm deployments via a `polarproxy.env` file. • Ships with a software bill of materials (SBOM) in SPDX format as `polarproxy.spdx.json`, covering all components, libraries, and dependencies for supply-chain transparency and vulnerability scanning integration. • Bundles a `docker-compose.yml` (musl builds) or a `systemd` unit file with `install-polarproxy-service.sh` (non-musl Linux builds) to simplify initial deployment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog&month=2026-09&post=PolarProxy-2-0-2-Released https://www.netresec.com/?page=Blog&month=2026-09&post=PolarProxy-2-0-2-Released Tue, 08 Sep 2026 12:35:00 GMT PolarProxy 2.0.2 adds SOCKS client tunneling, environment-variable config, idle connection timeouts, and an SPDX SBOM. • Adds `--connect socks5:<host>:<port>` (and `socks4`) to tunnel outgoing connections through an upstream SOCKS4 or SOCKS5 proxy server, enabling use cases such as routing decrypted TLS inspection traffic through Tor. • Adds `--idletimeoutclient <seconds>` and `--idletimeoutserver <seconds>` flags to close idle 'dead' connections on the client or server side; complements existing `--timeout <seconds>` (TCP handshake) and `--tlstimeout <seconds>` (TLS handshake) flags. • Adds `--writeall` flag to extend PCAP-over-IP output to include all proxied traffic, not just decrypted TLS. • Adds `--helpenv` flag to print all supported environment variables. • Supports environment variables with the `PP_` prefix (e.g. `PP_SOCKS` maps to `--socks`) as an alternative to command-line arguments, enabling clean config/app separation for systemd, Docker, Podman, Kubernetes, and Helm deployments. • Ships a `polarproxy.spdx.json` SBOM in SPDX format, listing all components, libraries, and dependencies for supply-chain transparency and vulnerability-scanner integration. • Ships a `docker-compose.yml` (musl builds) or systemd unit file with `install-polarproxy-service.sh` (non-musl Linux builds) to simplify deployment alongside a `polarproxy.env` configuration file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog&month=2026-08&post=CNCMachineRMS-C2-Protocol https://www.netresec.com/?page=Blog&month=2026-08&post=CNCMachineRMS-C2-Protocol Fri, 21 Aug 2026 14:45:00 GMT NETRESEC adds CNCMachineRMS C2 protocol detection to FlowCarp, with a free PCAP submission API for instant triage. • Adds a statistical detection model for the CNCMachineRMS binary C2 protocol to FlowCarp, enabling identification of this RAT's traffic on TCP port 443 without TLS decryption. • Exposes the FlowCarp demo server at `https://demo.flowcarp.com` accepting raw PCAP uploads via `curl --data-binary` and returning JSON alerts when CNCMachineRMS traffic is detected. • Documents four confirmed CNCMachineRMS C2 server IPs — `89.110.110.119:443`, `85.158.110.78:443`, `89.124.79.98:443`, `144.124.242.171:443` — and two associated domains (`notepadreleased[.]com`, `triotmelon[.]com`) as actionable network IOCs. • Documents the malware's DNS-over-HTTPS evasion technique — queries routed to `dns.google`, `cloudflare-dns.com`, and `dns.quad9.net` over TLS — so defenders know local DNS logs will not capture the C2 domain lookup and should alert on DoH connections preceding port 443 C2 activity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec https://www.netresec.com/?page=Blog https://www.netresec.com/?page=Blog Fri, 05 Jun 2026 00:00:00 GMT PolarProxy 2.0.1 prioritizes accurate PCAP output over throughput and reduces memory overhead. • Prioritizes accurate PCAP output by rate-limiting proxied traffic if the real-time PCAP-over-IP consumer falls behind, preserving every decrypted packet for forensic analysis • Reduces CPU and memory use by caching less data through a major overhaul of the data-flow logic to support more simultaneous sessions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netresec