Forking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what happened when they forked Apollo, built a custom obfuscation pipeline to defeat EDR detection, and spent months fighting an architecture that was never designed for it.
From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion
About this summary. This is a short, independently written summary of an article first published by Bishop Fox. Cyber Security News did not report or verify the underlying story. Read the original: https://bishopfox.com/blog/from-fork-to-framework-what-modifying-apollo-taught-us-about-agent-invasion
Source attribution: headline and facts are from Bishop Fox (bishopfox.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Malicious npm packages evade install-script defenses at runtime
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 115
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Gray Rabbits and…
An undercover Google analyst infiltrated a notorious supply-chain hacking gang
Before two of its alleged members were arrested and charged in Australia last month, the hacker group known as TeamPCP carried out a hacking spree unlike any other in…
Security Affairs newsletter Round 595 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new…
International investigation identifies over 70 potential victims exploited in Indian restaurants
The coordinated action conducted on 18 September 2026 led to two arrests. Allegedly, the traffickers forced their victims to work up to 16 hours per day, underpaid them…
Two-week Europol task force identifies 18 sexually abused children worldwide
The Victim Identification Task Force brings together experts from across the globe to combat child sexual exploitation. During the VIDTF, specialists analyse data…