- Name
- The wire
- Series
- Veneficus Mini
- Phase
- 4 · The wire
- Type
- 0-day analysis
- CVE
- n/a
- CVE Risk
- high
- Disclosure Status
- public
- Vendor
- n/a (private implant kit, source released)
- Affected
- Windows 10/11 x64 workstations
- Published
- 04 Sept 2026
- Updated
- 04 Sept 2026
- Tags
- 0-day, malware, c2, aes-gcm, cloudflare, telegram, series
This page is the control plane: AES-256-GCM on the blobs, keyed from the agent id as a UTF-8 string, with a Cloudflare Worker in front of a chat bot.
Channel crypto
Public name in the tree: GoldenGhost (aes_gcm_crypto.rs). AES-256-GCM, 12-byte random nonce, standard Base64. HMAC-SHA256 on the side with a constant-time compare. From-seed is SHA-256 of the seed, no salt, no HKDF. Control-channel use: SHA-256 of IMPLANT_UUID.
GCM authenticates the ciphertext. HMAC-SHA256 sits alongside it. IMPLANT_UUID is a plaintext UUID-shaped string baked into the PE, strings finds it, and SHA-256 of those bytes is the channel key. Possession of the binary is possession of the loot. A defender who recovers the sample decrypts /exfil blobs without talking to anyone.
The wrapper itself is small: correct nonce handling, fail closed on open. The worker never decrypts, and that part is correct: Cloudflare staff should not be able to read loot. The operator is supposed to decrypt offline with SHA-256 of the UUID.
Edge relay
Public path strings from worker.js and c2.rs: /beacon /exfil /commands /config /admin /register /unregister /listing /set_config. Those are the strings in this tree.
| Who | Path | Job |
|---|---|---|
| Agent | POST /exfil |
Sealed blob: agent id, tag, ct, nonce, hmac |
| Agent | POST /commands |
Pull jobs. One-shot. Deleted after read. Jobs travel in the clear. |
| Agent | POST /config |
Operator JSON: clipper addresses, replacement URL |
| Dropper | GET /beacon |
Image fetch |
| Operator | POST /admin |
Queue a job. Header X-Admin-Key. |
| Operator | POST /register / /unregister |
Allow-list |
| Operator | GET /listing |
List agent ids |
| Operator | POST /set_config |
Push clipper config |
Intended model: Cloudflare Worker as a CDN-fronted, keyless relay. Telegram Bot API as the operator's phone. AES-GCM so the edge cannot read. Chat gets a notify; the operator decrypts offline.
HTTP client (c2.rs): one TLS session, browser-like User-Agent, short timeout, singleton. First action in the loop: post a hello-shaped blob. Poll 10 s full / 60 s quiet, plus-or-minus a fraction of jitter, minimum 1 s. /sleep N overrides. That jitter is the difference between a loop a SOC graphs in five minutes and a loop a SOC graphs in an hour.
A defender still gets: one Worker hostname, periodic POSTs, JSON field for the agent id, a chat bot token in Worker secrets. Domain fronting is not implemented. Cover traffic is a Chrome UA and jitter. Still periodic POSTs to one host.
The tree as published does not hand you a live C2. c2.rs is the file to read if you want to know why. Elite enough, you already knew where to look.
Command surface
Dispatcher in c2.rs:
| Job | Effect |
|---|---|
/self_destruct |
self_destruct::execute(true): wipe image, clear logs, exit |
/re_infect |
HTTPS GET replacement URL, spawn, then burn |
/status |
Exfil PID, relay flag, quiet flag, agent id |
/proxy_on |
Unblock SOCKS-like accept (skipped in quiet) |
/proxy_off |
Set the flag off. Socket still bound. |
/exit_safe |
Clear quiet flag. Does not start skipped threads. |
/enter_safe |
Set quiet. Threads already running keep running. |
/sleep N |
Base poll interval |
| anything else | Ignore |
Concealment, driver pool, persistence, relay, hidden view, and clipper start once at process start, so /exit_safe is a toggle on a flag the process already committed.
Loopback relay (proxy.rs): real SOCKS5 CONNECT for IPv4 and domain, no auth, binds localhost by default, busy-waits until /proxy_on. Hidden view (hvnc.rs): RFB 3.8 handshake, security none, 1920x1080 named display, intended as a hidden desktop (CreateDesktop). Combined with localhost binds, remote access wants a tunnel.
What I would hunt
No victim C2 domain, chat token, or clipper wallet is hardcoded, only placeholders, so hunt the design.
Host, class-level
sc createwithtype= kerneland a binPath under the user temp directory (event 7045).- PowerShell creating a permanent WMI filter/consumer/binding in
root\subscription. - On-logon scheduled task running the same image as SYSTEM.
- HKLM Run value pointing at a user-writable path.
wevtutil cl Securityspawned by a user-writable image (event 1102).- In-process
VirtualProtectagainst the AMSI scan export or ntdll ETW event-write.
The concrete names the tree uses are in byovd.rs, persistence.rs, and loader.ps1.
Network, class-level
- HTTPS POSTs to a Worker-shaped host with JSON keys for an agent id, a tag, ciphertext, nonce, hmac.
- A second POST that pulls a job array and a third that pulls a profile.
- Chat API
sendMessageoriginating from Cloudflare's address space, not from the victim. - An outbound HTTPS to a well-known site at process start (the scoring check).
If a PE ever ships
Veneficus,GoldenGhost, a UUID v4 sitting next to an AES wrapper.- Relocatable strings from a Rust release with symbols stripped and panic=abort.
I do not have a compiled hash, and I am not going to pretend I do.
What I am not publishing
Patch bytes. Control codes. XOR keys. A Worker you can paste into wrangler. A dropper you can paste into a victim. The last mile of a working build.
Source is on GitHub. Catalog. You will figure out how to recreate it if you are elite enough. The rest of us can hunt the shape.
Static review, no execution. The orchestrator has phases, the score has weights, and the channel has an AEAD.