VShell: Tracking a State-Actor C2 Framework in the Wild
Michel and Patrick from NVISO present VShell as a Chinese-language post-exploitation command-and-control framework used in real incident-response cases, and the value proposition of the talk is practical: understand what VShell is, how its infrastructure can be tracked on the internet, and why defenders should focus on both vulnerable entry points and C2 fingerprinting. They explain that their research began with multiple client compromises, where investigation leads pointed toward VShell. A CSBN report connected the framework to a Chinese state-sponsored threat actor referred to as UNC 5174, and NVISO then sought to understand the tooling in more depth by locating a copy of the deleted GitHub distribution through an archived online source.
Core of Tech+1 other speaker
