NukeRat is a post-exploitation and C2 framework intended for authorized red team operations and adversary simulation against modern, hardened corporate networks.
| Tool | nukeratframework/nukerat — a TypeScript-based post-exploitation framework for advanced red team operations with cross-platform implants |
| Category | Command-and-control / post-exploitation framework |
| Primary Use | Authorized adversary simulation and red team engagements, using adapted BOF and .NET tradecraft, LOLBAS integration, and a custom C2 channel |
| Safe Use | Deployment only inside contracted, authorized penetration tests and isolated lab environments against systems the operator owns or has written permission to test |
| Telemetry Note | The framework itself reports IOCs, executed commands, and compromised hosts for engagement documentation; defenders should monitor for AMSI/ETW patching behavior, indirect-syscall anomalies, and LOLBAS execution patterns documented in its own reporting output |
NukeRat, published at nukeratframework/nukerat, positions itself as a post-exploitation framework aimed at what it calls advanced red team operations against modern and complex environments. With roughly 163 stars and a TypeScript codebase released under GPL-3.0, it joins a crowded field of Cobalt-Strike-alternative C2 platforms, but its README signals a deliberate design philosophy: bundle a very large library of adapted tradecraft, make implants portable across operating systems, and lean hard into living-off-the-land techniques rather than depending solely on custom tooling. This writeup is a documentary analysis of what the repository actually exposes, intended for defensive professionals and authorized operators who need to understand the capability landscape.
The headline feature is what the project calls the Armory: a catalog of more than 550 adapted BOF (Beacon Object File) and .NET utilities. From an architectural standpoint this tells you the implant runtime can execute position-independent code in-process, which is the same execution model popularized by Cobalt Strike and later frameworks like Sliver and Brute Ratel. The sheer count matters for defenders because it means detection engineering cannot rely on a small set of tool signatures; the tradecraft surface is effectively a superset of the public BOF ecosystem, which is why the project's GitHub topics include cobalt-strike explicitly.
The communication layer is described as a custom C2 with support for external platforms such as Telegram and Discord. Outsourcing the transport to consumer messaging infrastructure is a well-known trend because it blends into traffic that is already common on endpoints and at network egress, and it complicates sinkholing or infrastructure takedowns since the operator's relay rides on legitimate third-party services. For blue teams, the practical implication is that C2 detection increasingly shifts to host-side behavioral telemetry rather than blocking known-bad IP ranges.
Runtime evasion gets its own feature row, listing indirect syscalls, stack spoofing, sleep mask, and AMSI/ETW patching. Indirect syscalls route API calls through legitimate syscall stubs to frustrate userland hooks; stack spoofing attempts to make call stacks look benign when memory is scanned during sleep; sleep mask encrypts or obfuscates the implant while it is dormant; and patching AMSI and ETW targets the two main Windows sensor pipelines that feed EDR products. Each of these is a documented, publicly discussed technique, and their presence confirms the framework is engineered specifically against modern commercial endpoint detection.
On the injection side, the README enumerates allocation modes including VirtualAlloc, section-based allocation, and module stomping. Module stomping is the most notable of the three because it writes malicious code into legitimately mapped modules, which makes the memory region appear to belong to a trusted binary rather than freshly allocated anonymous memory. The framework also advertises static evasion via PE customization, and the license section reveals an embedded copy of SGN, Ege Balcı's encoding library, under MIT inside server/infra/bin/encoders/sgn/, which hints at binary-level polymorphism in the build pipeline.
The LOTL integration is arguably the most distinctive operational claim: more than 240 native Windows binaries from the LOLBAS dataset are integrated, and the repo actually vendors the upstream LOLBAS reference data under server/core/utils/messages/lolbins/reference/LOLBAS/. From a defensive perspective this is double-edged. The same integration that makes the framework stealthy also means that detection guidance published by the LOLBAS project and Microsoft maps directly onto NukeRat behavior, giving defenders a concrete, well-documented hunting baseline rather than an opaque unknown.
Implant coverage is cross-platform: Windows, Linux, and macOS including ARM support, with Linux implants compatible with Linux BOFs. The presence of Nim-based cryptography utilities adapted from nimcrypto (Eugene Kabanov's MIT-licensed library) inside implants/linux/stageless/utils/ suggests at least the Linux implants are written in or make heavy use of Nim, a language increasingly favored for offensive tooling because compiled binaries have relatively sparse analyst tooling and signature coverage compared to C/C++. Cross-platform support with ARM means the framework is realistic against mixed fleets including macOS laptops and ARM-based cloud or container hosts.
An unusual row in the feature table is AI integration, described as supporting agents such as DeepSeek and local models. The README gives no operational detail on how deeply AI is wired into tasking or tradecraft selection, so any stronger claim would be speculation; taken at face value it likely assists operators with session management or command generation rather than autonomous operation. Still, it reflects a broader industry pattern of C2 frameworks adding LLM assistance, which itself raises data-handling questions engagement leads should evaluate before pointing any AI feature at client-derived context.
The reporting capability is the part that matters most for lawful use: the framework documents executed commands, IOCs, and compromised hosts. Every credible red team engagement ends in a written deliverable, and a framework that natively tracks its own activity reduces the risk of undeclared actions during an operation. Combined with the operator key model shown in the setup snippet — ./nukerat.py server key add operator — this indicates a multi-operator server/client architecture with per-operator authentication, which is standard for team-based engagements and useful for attribution during deconfliction with a blue team.
Setup is a conventional two-step flow on Linux: git clone https://github.com/nukeratframework/nukerat && cd nukerat && sudo bash install.sh all, followed by ./nukerat.py server start and ./nukerat.py client start on the operator side. The server/client split mirrors commercial platforms, and documentation is hosted at nukerat.com/docs in English, Spanish, Korean, Simplified Chinese, Russian, Persian, and Japanese — an unusually broad localization set that signals the project's intended international user base.
Legally and ethically, a framework of this capability class is a double-edged instrument. In the hands of an authorized red team operating under a signed rules-of-engagement document, it is a legitimate simulation tool; deployed against systems without permission it is functionally malware, and nothing in its evasion-heavy design changes that assessment. Operators should treat the external Telegram/Discord relays, AI integrations, and GPL-licensed third-party components as additional review surfaces: verify what data leaves the engagement environment, and confirm licensing obligations under GPLv3 and the embedded MIT components are respected in any derivative tooling. For defenders, the IOC and LOLBAS visibility the framework itself produces is the best starting point for building detections against this class of tooling.
nukeratframework/nukerat.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.