Twenty in Eighteen Hours: Tracking the NetScaler Second Wave Through Its Own Constants
A follow-up investigation to the pitboss teardown: pivoting the public malware corpus on the passwords, tokens, and placeholder strings extracted from the campaign samples turns two copycat bundles into a twenty-deployment operation with three code generations, surfaces chisel on the exfil host, doubles the Platypus enrollment count, and recovers a victim's implant config that phoned a lab address that does not exist. With the pivot methodology, its traps (the MD5 test vector that fakes attribution), and expanded IOCs.