Description

Network Manager is a feature only present in most sophisticated Remote Access Trojans (RATs) and Command and Control (C2) frameworks. This component grants attackers granular visibility into and control over the network stack of a compromised host. Its capabilities extend far beyond simple reconnaissance and play a pivotal role in various phases of an attack lifecycle, including discovery, lateral movement, and data exfiltration.

At a high level, the Network Manager feature typically offers the following capabilities:

• Active Connection Monitoring: Allows enumeration of all active network connections by associated processes. This includes remote IP addresses, ports, protocols (TCP/UDP over IPv4 and IPv6), and connection states (e.g., ESTABLISHED, LISTENING).

• Network Configuration Retrieval: Extracts network adapter settings, DNS configurations, gateway information, and in some cases, stored credentials for Wi-Fi networks, including SSIDs and saved passwords.

• Connection Manipulation: Enables the attacker to initiate outbound connections (for data exfiltration or pivoting), or forcibly terminate existing connections (e.g., to disrupt legitimate user sessions or free up ports).

• Network Share Enumeration: Lists accessible file shares, including open SMB (Server Message Block) shares, mapped drives, and discoverable Windows network shares.

• Lateral Movement Support: By analyzing open ports and active connections, the attacker can identify adjacent systems and potential entry points for lateral movement within the environment.

• Network Resource Transfer: Use of alternative network protocols such as HTTP to exfiltrate data or fetch payloads, including mounting an HTTP, FTP or SSH server on the victim machine or leveraging an HTTP client to retrieve attacker-hosted resources.

• Packet Sniffing: Captures and analyzes live network traffic passing through the compromised system, allowing attackers to extract sensitive data (such as credentials or confidential documents), monitor user activity etc.

• Port Redirection / Proxy: Channels network traffic between local or remote ports, enabling attackers to bypass firewalls, mask their true origin by using the compromised host as a proxy, and facilitate deeper access into the network by rerouting traffic to internal targets.

• Port Scanning: Probes internal or external systems to identify open ports and exposed services, providing reconnaissance for further exploitation.

Existing Techniques

Name	Associated Feature(s)	Has Snippet	Matching Sample
Network Shares Enumeration	File Manager, Network Manager		0
Port Scanner	Network Manager		0

Associated with Release

Version	Origins	Authors	Languages	Release Date
Quasar 1.0	Unknown 🏴‍☠️	MaxXor	C#	Aug, 2015