Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment

This report documents discovery of an exposed command-and-control open directory hosting a complete BYOB RAT deployment (dropper, stager, payload) that targets Windows, Linux and macOS. The multi-stage Python malware implements multiple persistence mechanisms, encrypted HTTP C2, and post-exploitation features including keylogging, packet capture, and Outlook email harvesting; infrastructure pivots uncovered five C2 nodes (two also running XMRig miners) and a set of actionable IOCs and mitigation/detection guidance.