🧰 Chisel

The items that name it 7

• Blinder Tunnel Campaign Targets Iraqi Infrastructure
  article2026-10-06

  Open-source tunneling utility misused by attackers (via Blackwood loader) to establish encrypted TCP tunnels over HTTP with SOCKS5 proxy support for lateral movement.

• CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD
  writeup2026-10-06

  Tunneling tool used by attackers for further tooling/lateral movement during post-compromise activity.

• ​​Beyond source code: A path to the keys to the kingdom
  writeup2026-09-29

  Tunneling utility downloaded and used by the threat actor to establish a reverse tunnel to an external IP address and expose the Kubernetes API server.

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  article2026-09-17

  Tunneling tool used to establish network routes into the attack platform.

• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  article2026-09-01

  Tunneling utility to restrict

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeup2026-06-16

  Reverse SOCKS tunnel tool deployed by the attacker during hands-on-keyboard lateral movement.

• SanMuzZzZz/LuaN1aoAgent
  repo2026-05-08

  Runtime-managed tunneling/route connector for scoped reachability