Description

Network Manager is a feature only present in most sophisticated Remote Access Trojans (RATs) and Command and Control (C2) frameworks. This component grants attackers granular visibility into and control over the network stack of a compromised host. Its capabilities extend far beyond simple reconnaissance and play a pivotal role in various phases of an attack lifecycle, including discovery, lateral movement, and data exfiltration.

At a high level, the Network Manager feature typically offers the following capabilities:

• Active Connection Monitoring: Allows enumeration of all active network connections by associated processes. This includes remote IP addresses, ports, protocols (TCP/UDP over IPv4 and IPv6), and connection states (e.g., ESTABLISHED, LISTENING).

• Network Configuration Retrieval: Extracts network adapter settings, DNS configurations, gateway information, and in some cases, stored credentials for Wi-Fi networks, including SSIDs and saved passwords.

• Connection Manipulation: Enables the attacker to initiate outbound connections (for data exfiltration or pivoting), or forcibly terminate existing connections (e.g., to disrupt legitimate user sessions or free up ports).

• Network Share Enumeration: Lists accessible file shares, including open SMB (Server Message Block) shares, mapped drives, and discoverable Windows network shares.

• Lateral Movement Support: By analyzing open ports and active connections, the attacker can identify adjacent systems and potential entry points for lateral movement within the environment.

• Network Resource Transfer: Use of alternative network protocols such as HTTP to exfiltrate data or fetch payloads, including mounting an HTTP, FTP or SSH server on the victim machine or leveraging an HTTP client to retrieve attacker-hosted resources.

• Packet Sniffing: Captures and analyzes live network traffic passing through the compromised system, allowing attackers to extract sensitive data (such as credentials or confidential documents), monitor user activity etc.

• Port Redirection / Proxy: Channels network traffic between local or remote ports, enabling attackers to bypass firewalls, mask their true origin by using the compromised host as a proxy, and facilitate deeper access into the network by rerouting traffic to internal targets.

• Port Scanning: Probes internal or external systems to identify open ports and exposed services, providing reconnaissance for further exploitation.

Existing Techniques

Name	Associated Feature(s)	Has Snippet	Matching Sample
Network Shares Enumeration	File Manager, Network Manager		0
Port Scanner	Network Manager		0

Associated with Releases

Version	Origins	Authors	Languages	Release Date
NetBus 1.70	Sweden 🇸🇪	cf	Delphi	Nov, 1998
Back Orifice 2000 (BO2K) 1.0	United States 🇺🇸	Cult of the Dead Cow (cDc)	C++	Jul, 1999
SubSeven 2.1	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Nov, 1999
SubSeven 2.1.1 GOLD edition	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Feb, 2000
SubSeven 2.1.2 M.U.I.E	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Apr, 2000
SubSeven 2.1.3 BONUS	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Jun, 2000
SubSeven 2.1.4 DEFCON 8	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Jul, 2000
SubSeven 2.2	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Mar, 2001
Ghost 2.4	Israel 🇮🇱	Lame_Joker	Visual Basic 6 (VB6)	Sep, 2002
MoSucker 3.0b	Germany 🇩🇪	Superchachi	Visual Basic 6 (VB6)	Nov, 2002
SubSeven 2.1.5 Legends	Romania 🇷🇴, Canada 🇨🇦	Mobman	Delphi	Feb, 2003
Beast 2.01	Romania 🇷🇴	Tataye	Delphi	Jun, 2003
Optix Pro 1.32	Unknown 🏴‍☠️	s13az3 , xMs	Delphi	Sep, 2003
CIA 1.2	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Sep, 2003
Beast 2.05	Romania 🇷🇴	Tataye	Delphi	Sep, 2003
Beast 2.02	Romania 🇷🇴	Tataye	Delphi	Sep, 2003
Nuclear RAT 1.0 Beta 5	Brazil 🇧🇷	caesar2k	Delphi	Feb, 2004
Beast 2.06	Romania 🇷🇴	Tataye	Delphi	Feb, 2004
Infector NG 2004 2.1.0	Belgium 🇧🇪, United Kingdom 🇬🇧	fc , Infiltration	Delphi	May, 2004
Optix Pro 1.33	Unknown 🏴‍☠️	s13az3	Delphi	Aug, 2004
Beast 2.07	Romania 🇷🇴	Tataye	Delphi	Aug, 2004
Flux 1.0	Unknown 🏴‍☠️	Gargamel	C++	Aug, 2004
Institution 2004 0.4.0	United States 🇺🇸	Aphex	Delphi	Oct, 2004
CIA 1.3	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Dec, 2004
Seed 1.1	Brazil 🇧🇷	caesar2k	Delphi, C++	Feb, 2005
Bandook 1.35	Lebanon 🇱🇧	PrinceAli	Delphi, C++	Apr, 2007
Poison Ivy 2.3.0	Sweden 🇸🇪	Shapeless	Delphi, MASM	Jun, 2007
sharK 2.4.0 Fwb+	Germany 🇩🇪	sNiper109 , rockZ	Visual Basic 6 (VB6)	Aug, 2007
Nuclear RAT 2.1.0	Brazil 🇧🇷	caesar2k	Delphi	Sep, 2007
Poison Ivy 2.3.2	Sweden 🇸🇪	Shapeless	Delphi, MASM	Jan, 2008
sharK 3.1 fwb++	Germany 🇩🇪	sNiper109 , rockZ	Visual Basic 6 (VB6)	Mar, 2008
Spy-Net 2.6	Brazil 🇧🇷	Raphael	Delphi	Oct, 2009
DarkComet RAT 2.0 RC4	France 🇫🇷	DarkCoderSc	Delphi	Mar, 2010
CyberGate 1.04.8	United States 🇺🇸	johnyk	Delphi	Apr, 2010
DarkComet RAT 2.0 RC7	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2010
Xtreme RAT 2.9	Brazil 🇧🇷	Raphael	Delphi	Jul, 2011
DarkComet RAT 5.3	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2012
DarkComet RAT 5.3.1	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2012
Quasar 1.0	Unknown 🏴‍☠️	MaxXor	C#	Aug, 2015