Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice

Proofpoint published an analysis of Nighthawk. They observed campaigns with Nighthawk in September 2022, most likely sent by a red team, and saw no leaked copies in the hands of attributed threat actors. Nighthawk is the C2 framework released by MDSec in 2021. In the past threat actors heavily utilized Cobalt Strike, followed by Sliver. As threat actors search for new tools, they will probably also turn to Nighthawk at some point. MDSec answered the next day that the post was speculative, published unreleased EDR bypass techniques obtained by reverse engineering, and came without any advance contact. The vendor also listed its customer vetting, from ownership checks to a three-seat minimum, plus per-customer watermarked builds.