The teeth

This is the page where the "red-team implant" disclaimer runs out of air. A scoring function can be dual-use. A WMI subscription can be dual-use. A clipboard hijacker that rewrites coin addresses is not dual-use, because red teams do not steal victim funds.

Harvest orchestrator

On run() in payload/mod.rs the agent does three wired jobs, in order:

1. Host card: hostname, OS, kernel, memory, CPU count, machine GUID, username, agent id, quiet flag. Posted as tag fingerprint.
2. Browser logins: URL / user / password triples. Posted as credentials.
3. OS secret-store dump to a throwaway temp file, base64 the whole thing, post as a dump tag, delete the file.

Chromium family (Chrome, Edge, Brave, Opera, Vivaldi) in steal.rs: copy the login and cookie stores aside to dodge the SQLite lock, SELECT, then the same-user CryptUnprotectData path. That is the older blob. Chrome v10/v20 AES-GCM under a key in Local State (os_crypt.encrypted_key) and v20 app-bound encryption sit outside it, and the cookie DB has also moved (Network\Cookies).

Firefox: walk profiles, ship the encrypted username/password prefixed as "decrypt this offline," and leave key4.db for the operator to finish with NSS.

Secret-store dump (lsass.rs). Native full-memory dump via MiniDumpWriteDump after enabling SeDebugPrivilege and opening the process (T1003.001). On modern Windows the target is PPL (RunAsPPL), so the native path needs a kernel primitive that stripped PPL first, a misconfigured host, or a context that does not care. Fallback is helper tools, then the driver pool against that PID, then retry.

Clipboard swap

Every 250 ms in clipper.rs the loop opens the clipboard, reads Unicode text, and regex-replaces it with operator addresses from the profile (T1565.002, T1115).

Coin classes in the tree: Bitcoin (Base58 and Bech32 as separate keys), Ethereum, Litecoin, Monero, Dogecoin, Solana, XRP, BNB, USDT-TRC20. I am not printing the regexes. Solana matching is broad enough to rewrite random Base58, including text that is not an address. Bech32 Bitcoin is a separate profile key from Base58, so the operator has to set both if they want both formats replaced.

This module is the clearest criminal-intent signal in the kit: a loop, a profile fetch, a table of patterns, and a default poll that is fast enough to catch a paste.

The driver pool

Bring Your Own Vulnerable Driver. Needs admin. Noisy: service install, kernel load, event 7045, every modern EDR watching. The pool in byovd.rs is tried in order. Images are read at runtime from a directory; a missing file skips the slot. drivers/ ships empty.

Control-code numbers stay in the source file. Public CVEs stay here. The bugs in this table are n-days. The kit that catalogs them is not.

Mechanism, generic: drop the image to temp, create a kernel service, start it, open the device, send a packed PID, stop, delete. An ordered fallback pool of signed drivers is how current ransomware crews actually work; Kaspersky's ThrottleStop write-up is the public literature this catalog is standing on.

Hosts do not need the legitimate software installed, because BYOVD brings the .sys. Microsoft's vulnerable-driver blocklist, HVCI / memory integrity, and App Control are the primary host mitigations. Keep LSASS RunAsPPL. Keep Chrome app-bound encryption. Those blunt the harvest even if the agent runs.

Lateral

There is a coerce module (lateral/ntlm.rs) with PrinterBug and PetitPotam names in it, plus a comment pointing at CVE-2025-33073. It is not on the entry path.

ATT&CK, compressed

There is no ransomware module and no file encryptor, which is one of the reasons this is a different family than VEN0m.

Next: the wire. None of the loot matters if the phone home is a ghost.