CTT Report Hub on Telegram: “#ParsedReport #CompletenessLow 04-09-2026 Neithe…”

CTT Report Hub @aptreports · 3.52K subscribers

Post #32176 52 Sep 7, 2026, 17:15 UTC

#ParsedReport #CompletenessLow
04-09-2026

Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet

https://censys.com/blog/nps-proxy-server/

Report completeness: Low

Actors/Campaigns:
Bronze_starlight

Threats:
Nps_tool
Cobalt_strike_tool
Meterpreter_tool
Acunetix_tool
Viper
Supershell
Disttrack
Wannacry

Victims:
Citrix netscaler devices

Industry:
Telco

Geo:
Hong kong, China, Chinese

ChatGPT TTPs:
do not use without manual check
T1090.001, T1505.003, T1543.003, T1572, T1573

IOCs:
File: 1
IP: 1

Soft:
Linux, macOS

Win API:
ARC

Links:
have more...
https://github.com/ehang-io/nps
http://github.com/djylb/nps

Censys Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet - Censys Most deployments of the NPS tunneling tool are benign. Some are not. Censys ARC shares signals for distinguishing the benign from the malicious.

Open in Telegram All posts from @aptreports