Blog

Intelligence report acronym INTREP text macro closeup, typewriter typed intel insight facts summary reporting document concept, brief concise operations issues memo bulletin notice for operational actions and decisions planning, information letter message

We are thrilled to announce the launch of our comprehensive Offensive Threat Intelligence academy!🎯 We are the only real offensive intelligence training provider on the market! Get real, practical skills you need to deanonymize threat actors, deploy honeypots, and infiltrate highly sensitive criminal circles - all while mastering the best operational security practices.🥷 𝗖𝗦-𝗢𝗦𝗧𝗜 (𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗳𝗼𝗿 𝗧𝗵𝗿𝗲𝗮𝘁 𝗜𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲) The CS-OSTI course is designed for cybersecurity specialists who want to enhance their skills in threat intelligence and hunting on the dark web while ensuring operational security.🕵️ 𝗖𝗦-𝗔𝗗𝗪𝗜 (𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗗𝗮𝗿𝗸 𝗪𝗲𝗯 𝗜𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲) The CS-ADWI course is tailored for cybersecurity professionals seeking to deepen their understanding of dark web intelligence, honeypotting, tracing privacy cryptocurrencies (Monero) and deanonymizing threat actors.🔐 𝗖𝗦-𝗛𝗥𝗢𝗦 (𝗛𝗶𝗴𝗵 𝗥𝗶𝘀𝗸 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆) The CS-HROS course is an advanced, on-demand course with active participation in online classes, created to expand the knowledge of professionals in the field of high risk operational security, using advanced techniques, unavailable elsewhere.🎉 𝗦𝗽𝗲𝗰𝗶𝗮𝗹 𝗟𝗮𝘂𝗻𝗰𝗵 𝗢𝗳𝗳𝗲𝗿: 𝗨𝘀𝗲 𝘁𝗵𝗲 𝗰𝗼𝗱𝗲 CS-LAUNCH 𝘁𝗼 𝗴𝗲𝘁 𝗮 𝟯𝟯% 𝗱𝗶𝘀𝗰𝗼𝘂𝗻𝘁 𝗼𝗻 𝗮𝗹𝗹 𝗰𝗼𝘂𝗿𝘀𝗲𝘀!Don't miss this special offer, only for a limited time during our grand launch.<a data-mce-href="https://learn.covsec.ee" href="https://learn.covsec.ee" target="_blank" rel="noopener">🔗 learn.covsec.ee</a>

Covert Security - Offensive Threat Intelligence Academy

Vibrant clownfish swimming among sea anemones in a coral reef.

Phishing is a type of online scam where attackers trick you into giving sensitive information (passwords, payment details) or executing actions (downloading malware, clicking malicious links) by pretending to be someone trustworthy.<h3>Don't panic!</h3>In this case, this was simply a simulated test, contracted by your employer, meant to check the company's security level.If you are seeing this page, please contact your employer in order to receive mandatory phishing training (Won't take long, we promise) - or directly contact us - office@covsec.ee.How it worked here: The attacker sent an email that looked like it came from the business, but the sender address didn’t match the official Facebook and Instagram contacts and used an unusual domain (e.g. proton.me). That mismatch is a strong sign the message was fake. Why that matters: Scammers often spoof or use similar-looking addresses and uncommon domains to mimic legitimate services. Checking the exact sender address is one of the quickest ways to spot a fake.PDF's and links: Don’t open PDF attachments unless you’re certain who sent them - PDF's can contain embedded links or malicious content. Never click links inside an unexpected PDF - instead verify the sender by a separate channel (Official website, known phone number, or the business’s verified social media).

Got Phished? It's okay, let's fix that.

Most people treat Monero like it’s a black box. They assume once they hit "send", it’s all invisible. Anonymous. Untouchable.But Monero’s privacy guarantees start at the protocol level - not the network level. And that’s where most people get exposed.We built a tool to show how.🔥 Enter <a data-mce-href="https://github.com/covertsecurity/xmrpot" href="https://github.com/covertsecurity/xmrpot" target="_blank" rel="noopener">XMRPot</a> -&nbsp; a honeypot proxy designed to look like a public Monero remote node.Except it’s not.<ul><li>It doesn’t mine. </li><li>It doesn’t broadcast honestly. </li><li>It doesn’t care about helping the network.</li></ul>What it does do is log every connection that comes through:<ul><li>IP address</li><li>Endpoint requested</li><li>Raw POST data</li><li>Response returned</li><li>Timestamps</li></ul>All of it - Base 64 encoded and archived. In short: it’s a silent observer.<h3>🎯 What Does It Do?</h3>XMRPot acts as a fake Monero node that forwards requests to a real upstream node while recording everything in the middle.It exposes two hidden routes (secured via UUID):<ol><li>/monitor/ - dumps all logged request data </li><li>/statistics/ - returns summarized analytics:</li></ol><ul><li>Total requests. </li><li>Unique IP's. </li><li>Per-route usage breakdown. </li><li>No authentication. No complexity. Just spin it up and watch.</li></ul><h3>🧠 How It Works (Technical Breakdown)</h3><ol><li>Proxy Handling</li></ol><ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>It proxies any whitelisted Monero RPC endpoint to an upstream node. </li><li>It supports both GET and POST methods. </li><li>Unsupported routes return 404. </li></ul></li></ul>2. Logging<ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>IP (Via X-Forwarded-For or remote address).</li><li>Requested endpoint.</li><li>Sent data.</li><li>Received data.</li><li>Status code.</li><li>Timestamp.</li></ul></li></ul>Logs are stored in a flat "request_log.json" file (JSON array of entries). All data is Base64 encoded to preserve binary payload integrity. 3. Monitoring and Statistics<ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>/monitor/ - Dumps full log of actions. </li><li>/statistics/ - see below...<ul><li>Unique IP count.</li><li>Request counts per route.</li><li>Total request volume.</li><li>Deployment.</li></ul></li></ul></li></ul>4. Runing the Tool<ul><li style="list-style-type: none;" data-mce-style="list-style-type: none;"><ul><li>Run with: "python3 xmrpot.py" and that's it.</li><li>Listens on <a href="http://0.0.0.0:18081" data-mce-href="http://0.0.0.0:18081">0.0.0.0:18081</a> by default. </li><li>You get a randomized UUID for accessing sensitive routes on startup.</li></ul></li></ul><h3>🧨 Why This Matters</h3>Monero’s protocol is strong - no question.But the network layer is full of holes. If you connect to a malicious remote node (like this one), your metadata is exposed:<ul><li>Home IP's.</li><li>Timing correlation.</li><li>Potential to fingerprint wallet behavior.</li></ul>Most users never verify what node they’re talking to. They trust random ones. And trust, in a privacy system, is the biggest vulnerability.<h3>🔗 Source</h3>Tool source code: 👉&nbsp;<a href="https://github.com/covertsecurity/xmrpot" target="_blank" rel="noopener" data-mce-href="https://github.com/covertsecurity/xmrpot">github.com/covertsecurity/xmrpot</a> If you care about privacy, run your own node. If you're curious what people leak when they don’t pay attention - now you can watch.

Monero Isn’t Bulletproof: Meet XMRPot - The Honeypot Proxy for Passive Surveillance

Ransomware Data Breach Protection Cyber Security Email Phishing Encrypted Technology, Digital Information Protected Secured

When attackers tunnel covert channels through trusted infrastructure - like Cloudflare protected DNS-over-HTTPS or multimedia platforms - they bypass even the most hardened Fortinet and Checkpoint deployments.The result?✅ No alerts. ✅ No visibility. ✅ No suspicion - just normal-looking traffic.Here’s a curated list of tools and techniques that make this possible. Each leverages covert channel methods - some obscure, some highly advanced - to exfiltrate data or communicate with C2 infrastructure right under defenders’ noses.<h3>🔧 Kernel &amp; Driver-Level Covert Channels</h3>1. 🧬 cat-soup &nbsp; ➡️ eBPF-based Linux rootkit. Exfiltrates via kernel-level system call hijacking. &nbsp; GitHub: https://github.com/chumachok/cat-soup2. 🕓 NTPTunnel &nbsp; ➡️ Tunnels C2 over Network Time Protocol (NTP) messages. Low visibility. &nbsp; GitHub: https://github.com/ricklahaye/NTPTunnel3. 📡 NetworkCovertChannels &nbsp; ➡️ Protocol-hopping, protocol-switching, and active warden evasion techniques. Research-grade suite. &nbsp; GitHub: https://github.com/cdpxe/NetworkCovertChannels/tree/master<h3>🧬 Protocol Steganography</h3>4. 📜 x509 &nbsp; ➡️ Encodes data in TLS certificates (X.509 extensions). Invisible during HTTPS handshakes. &nbsp; GitHub: https://github.com/ProbieK/x5095. 🌐 IPv6-Attacks-and-Covert-Channels &nbsp; ➡️ Covert data in IPv6 extension headers, flow labels, and options. &nbsp; GitHub: https://github.com/n3m351d4/IPv6-Attacks-and-Covert-Channels6. 📘 IPv6teal &nbsp; ➡️ Exfiltration using IPv6 Destination Options and Hop-by-Hop headers. &nbsp; GitHub: https://github.com/christophetd/IPv6teal7. 🧬 DNSExfiltrator &nbsp; ➡️ Hides data in DNS requests (labels, TTLs, responses). Works with DNS-over-HTTPS. &nbsp; GitHub: https://github.com/Arno0x/DNSExfiltrator8. 🌐 WebDavDelivery &nbsp; ➡️ Uses HTTP WebDAV methods (PROPFIND) to deliver payloads via XML fields. &nbsp; GitHub: https://github.com/Arno0x/WebDavDelivery9. 📡 pingtransfer &nbsp; ➡️ Covert ICMP tunnel. Hides payloads in ping echo/reply packets. &nbsp; GitHub: https://github.com/yilmi/pingtransfer10. 🔧 Simple Packet Sender &nbsp; ➡️ Craft custom raw packets. Great for prototyping covert headers or timing channels. &nbsp; Website: https://sites.google.com/site/simplepacketsender/<h3>📶 Wireless &amp; Network Tunneling</h3>11. 📡 GhostTunnel-Go &nbsp; ➡️ Covert Wi-Fi C2 using 802.11 management frames. Cross-platform. &nbsp; GitHub: https://github.com/AmyangXYZ/GhostTunnel-Go12. 👻 GhostTunnel (C/C++) &nbsp; ➡️ Native implementation for stealthy layer-2 exfiltration over Wi-Fi. &nbsp; GitHub: https://github.com/PegasusLab/GhostTunnel13. 📶 WiFi_CCC &nbsp; ➡️ Chat-style covert channel using SSID beacon timing. &nbsp; GitHub: https://github.com/yadox666/WiFi_CCC/tree/master14. 🔁 WiFi_Reconnection_CovertChannel &nbsp; ➡️ Encodes bits via reconnection timing to APs. &nbsp; GitHub: https://github.com/NIoSaT/WiFi_Reconnection_CovertChannel<h3>🎧 Cloud &amp; Multimedia Channels</h3>15. 🎥 covert-tube &nbsp; ➡️ Encodes C2 data in YouTube video descriptions, metadata, or frames. &nbsp; GitHub: https://github.com/ricardojoserf/covert-tube16. 🎵 Pileus &nbsp; ➡️ SoundCloud-based C2 using steganography in audio tracks. &nbsp; GitHub: https://github.com/Bojak4616/Pileus<h3>🛡️ Detection &amp; Research</h3>17. 🔍 nefias &nbsp; ➡️ Network anomaly detection engine focused on detecting covert and stego channels. &nbsp; GitHub: https://github.com/cdpxe/nefias18. 📚 Research – “Covert Channels in IPv6” (Lucena et al.) &nbsp; ➡️ Landmark academic paper on IPv6 covert channel design. &nbsp; PDF: https://link.springer.com/content/pdf/10.1007/11767831_10.pdf19. 📚 ACM Covert Channel Paper &nbsp; ➡️ Early formalization of covert channel classification. &nbsp; PDF: <a href="https://dl.acm.org/doi/pdf/10.1145/2018436.2018518" data-mce-href="https://dl.acm.org/doi/pdf/10.1145/2018436.2018518">https://dl.acm.org/doi/pdf/10.1145/2018436.2018518</a> <h3>⚔️ Defensive Takeaways</h3><ul><li>🔁 Covert channels span all OSI layers: From layer 2 (Wi-Fi beacons) to layer 7 (TLS x509, DNS).</li><li>☁️ Trusted cloud services are abused: DNS-over-HTTPS, YouTube, SoundCloud, etc.</li><li>📊 Anomaly-based detection works: Tools like nefias use statistical header and timing analysis.</li><li>🧼 Protocol normalization: Strip or rewrite optional headers to disrupt steganographic channels.</li></ul>

Mastering Covert Channels to Become Invisible

Image of obscured secret computer hacker programmer youth wearing hoodie with dark programming computer code background, concept for cyber war hacking technology, encryption coding, Internet crime, software programming, digital data analysis

It's not just the bad guys that can hack - our team recently uncovered the real IP address of the server hosting Medusa Locker's blog and negotiation site, by exploiting a vulnerability in their blog.Medusa Locker primarily targets healthcare, education, and manufacturing sectors, with hundreds of reported attacks since its emergence in 2019. The group operates a Tor-based leak site to pressure victims, where they publish stolen data from organizations that refuse to pay.🧨 After uncovering a high severity vulnerability in Medusa Locker's ransomware blog - we successfully escalated and obtained the true IP address of their hidden host.<figure id="figure-zqtyjya97nm9he3na9"><img id="zqtyjya97nm9he3na9" src="https://cdn.durable.co/blocks/13Ynvsk7ytP0IEZxB7LWDLnK7gGuviseWhZ8S5TLHUl4NHfF0YtXODvjtQKEjs1h.png" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 16/9; object-position: 0% 50%;" data-corners="default" data-aspect="16:9" data-caption="Figure 1 - Censys results and real site exposed." data-positionX="0%" data-positionY="50%" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Figure 1 - Censys results and real site exposed.</figcaption></figure>📍 Our analysis reveals that the server is located in Saint Petersburg, Russia, hosted by Selectel, one of the largest Russian providers, known for accepting payments in Bitcoin and Litecoin.⏳ 𝘍𝘰𝘭𝘭𝘰𝘸 𝘰𝘶𝘳 𝘱𝘢𝘨𝘦 𝘵𝘰 𝘴𝘵𝘢𝘺 𝘶𝘱𝘥𝘢𝘵𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘯𝘥 𝘵𝘰 𝘣𝘦 𝘵𝘩𝘦 𝘧𝘪𝘳𝘴𝘵 𝘵𝘰 𝘬𝘯𝘰𝘸 𝘢𝘣𝘰𝘶𝘵 𝘰𝘶𝘳 𝘶𝘱𝘤𝘰𝘮𝘪𝘯𝘨 𝘢𝘥𝘷𝘢𝘯𝘤𝘦𝘥 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘤𝘦 𝘤𝘰𝘶𝘳𝘴𝘦!

Deanonymizing Medusa Ransomware's Onion Site

Computer hacker and computer software in the dark

Our team has conducted threat intelligence in the dark web space and identified a technique used to expose the real IP addresses, behind Cloudflare protected sites using authenticated origin pulls.⛓️‍ One of the first targets is "darknetlinks[.]info" - a link collection for dark web forums, marketplaces, exchanges and others.Our investigation showed that the site is using Cloudflare services to protect on a DNS-level, and on a server-level using authenticated origin pulls (AOP), to restrict server traffic only to Cloudflare servers.🗝️ Conducting certificate intelligence using Censys, our team identified their origin certificate with the fingerprint "02a43b2d77464a269fc32fccf79699dea82569215c37134331f7aaba54d63052" and one host "146[.]19[.]143[.]203" server, which serves their dark web link collection.<figure id="figure-wmnuqqlxrm9h7k6p7"><img id="wmnuqqlxrm9h7k6p7" src="https://cdn.durable.co/blocks/27sue0oWpm8N6fqwxpd7tOq4RjiesIn5pSEwHeS1HlJ1aCzhpJd1CceFWhINllND.jpg" alt="" title="" class="object-cover bg-gray-100 " style="aspect-ratio: 16/9; object-position: 0% 0%;" data-corners="default" data-aspect="16:9" data-caption="Figure 1 - Censys Results for 146[.]19[.]143[.]203." data-positionX="0%" data-positionY="0%" data-fullWidth="false"/><figcaption class="body-normal text-gray-500 mt-2">Figure 1 - Censys Results for 146[.]19[.]143[.]203.</figcaption></figure>🛡️ The technique and exposed target are part of Covert Security's upcoming CS-ADWI (Advanced Dark Web Intelligence) course, featuring topics such as...<ul><li>Monero transaction deanonymization through honeypot nodes.</li><li>Hidden service deanonymization on the dark web.</li><li>Deanonymization of Cloudflare protected services on the clear web.</li></ul>🎉 𝘚𝘵𝘢𝘺 𝘵𝘶𝘯𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘶𝘱𝘥𝘢𝘵𝘦𝘴 𝘢𝘯𝘥 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘴 𝘰𝘶𝘳 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘳𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘦𝘹𝘱𝘢𝘯𝘥𝘴.

Blog

Covert Security - Offensive Threat Intelligence Academy

Got Phished? It's okay, let's fix that.

Monero Isn’t Bulletproof: Meet XMRPot - The Honeypot Prox...

Mastering Covert Channels to Become Invisible

Deanonymizing Medusa Ransomware's Onion Site

Exposing the IP Address of a Dark Web Link Collection