Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool

This report details the discovery and technical analysis of Splinter, a Rust-based post-exploitation/red-team tool found on customer systems; it describes the implant's configuration format, capabilities (remote command execution, module injection, file transfer, cloud info gathering, self-delete), C2 URL paths, a sample SHA-256 indicator, and detection/mitigation guidance from Palo Alto Networks, while noting no attribution to a specific threat actor.