B1txor20 A Linux Backdoor Using DNS Tunneling
B1txor20 can be characterized is using DNS Tunnel to establish C2 channel, support direct connection and relay, while using ZLIB compression, RC4 encryption, BASE64 encodingto protect the traffic of the backdoor Trojan, mainly targets ARM, X64 CPU architecture of the Linux platform.
The main features currently supported are shown below.
SHELL
Proxy
Execute arbitrary commands
Install Rootkit
Upload sensitive information
Featured Resources
View More Resources
blog
CVE-2026-26117: Hijacking Azure Arc on Windows for Local Privilege Escalation & Cloud Identity Takeover
CVE-2026-26117 lets attackers hijack Azure Arc on Windows, escalate to SYSTEM, and seize the machine’s cloud identity.
Demo
Exposure Validation Demo
Demo of automated offensive simulations validating detection, prevention, and IOC coverage
blog
Validate What Matters: Simulate Real-World Identity and Privilege Attacks in AD and Entra ID
Identity is the new perimeter. The move to the cloud and remote work creates new security boundaries based on users and services operating across cloud and hybrid environments, making