BLUE TEAM THREAT INTELLIGENCE

Living Abuse Patterns & Defense Registry

An open, community-maintained catalog documenting real-world attack techniques across systems languages (Rust, C, Go, Nyx) and exact defender mitigations.

Pattern 1: Cloud & Git-as-C2 Channel (e.g. RUSTYSHADE)

HIGH SEVERITY

A backdoor binary leverages standard HTTPS client libraries (std.http / REST APIs) to poll private GitHub/GitLab repositories for encrypted command files, using issue threads or commit updates for bidirectional command-and-control.

🔍 Indicators of Compromise (IOCs) & Heuristics:

• Outbound TLS connections to api.github.com/repos/*/contents/* on 30s-120s beacons
• Obfuscated payload chunks loaded into memory with custom AES-GCM / ChaCha20 decryptors
• Execution of system discovery commands immediately following repository sync

🛡️ Nyx Defensive Mitigations:

  • Static SBOM Auditing: Inspect .nyx.sbom to detect if a tool contains unauthorized std.http or std.net calls.
  • Kernel Sandbox Isolation: Enforce nyx-sandbox --policy=isolated.toml with [network] allow_hosts = [] to completely disable kernel socket creation.

Pattern 2: Removable Media & USB Auto-Propagation

MODERATE SEVERITY

Malware listens to OS storage mount events and writes executable payloads alongside disguised Windows shortcut (.lnk) files directly to USB root directories.

🔍 Indicators of Compromise (IOCs) & Heuristics:

• Polling of drive letters (D:\, E:\) or /media/* mount points
• Dropping hidden .lnk files targeting powershell.exe or native binaries

🛡️ Nyx Defensive Mitigations:

  • Filesystem Path Sandboxing: Landlock / AppContainer rules denying write access outside designated application directories.

Pattern 3: Typo-Squatted Package Ingestion

SUPPLY CHAIN SEVERITY

An attacker publishes a library with a name that mimics an official package (e.g. @nyx-httpp instead of @nyx/http), hoping developers install it by mistake.

🛡️ Nyx Defensive Mitigations:

  • Namespace Scope Protection: The official @nyx/ scope is cryptographically reserved and signed by the sovereign team.
  • Deterministic Lockfiles (nyx.lock): Cryptographically binds package version to exact SHA-256 tarball hashes.
  • Jude Formal Certificates: Enterprise CI pipelines can require third-party packages to pass nyx-verify-cert prior to build.
← Security Limits & Formal Guarantees Security Architecture Overview →