Detached background process execution
Named by 4 kept items in this workspace.
Search every workspace for Detached background process execution. It matches the name as written, so it can find other things that share it.
The items that name it 4
Both launchers start the sckit binary detached/in a new session with stdio discarded/sent to /dev/null, so it keeps running after the parent process exits, and pass a copy of the full environment
Dropped binary launched with spawn(..., { detached: true, stdio: 'ignore', windowsHide: true }) followed by unref() to run silently in the background
Spawning the stage-2 payload with detached: true, stdio: 'ignore', and .unref() so it keeps running invisibly after npm exits
Payload spawned as a fully detached background process (stdio: ignore, windowsHide: true) invisible on all platforms, passing second C2 host 23[.]254[.]164[.]123:443 as an argument
All techniques in this workspace.