Ankura CTIX FLASH Update - September 24, 2024

Cybersecurity researchers have recently discovered a new red-teaming tool – "Splinter"- lurking on compromised systems post-incident. Splinter is similar to the well-known post-exploitation tool Cobalt Strike, but less advanced. Researchers dub the tool "Splinter" based on the internal project name spotted in a debugging artifact in its code. It is not yet known who developed Splinter or which threat groups have been attributed to its misuse. Splinter is developed in Rust, and its samples are very large due to the number of external libraries the file uses. Splinter uses a JSON format for its configuration data which contains the implant and targeted endpoint identifiers as well as the command-and-control (C2) server details. Splinter connects to its C2 server over HTTPS. Splinter's capabilities include running Windows commands, remote process injection, file uploads and downloads, information harvesting, and self-destructing. Splinter is a red team tool, which when