SecBox Analysis: Go-based implant with DDR via Pastebin/GitHub, Yamux multiplexing, and steganographic GLUTTON webshells hiding bytecode in PNG pixels

Sharing analysis of tooling from a campaign we tracked across five exposed open directories. SecBox is a Go remote-access framework deployed via webshells. The Windows builds masquerade as "System Configuration Utility" (syscfg.exe) with Microsoft-style PE metadata. On execution it selects an embedded or DDR-supplied endpoint and establishes a...