Executive Summary
In June 2026, Praetorian introduced WasmForge, a tool designed to compile Go-based offensive security tools like Sliver into WebAssembly (WASM). This approach enables the creation of binaries that can evade traditional Endpoint Detection and Response (EDR) systems by disguising the tool's signature and behavior. WasmForge achieves this by embedding the WASM module into a Go binary, which acts as a loader, effectively obfuscating the tool's presence and functionality.
The release of WasmForge highlights a significant advancement in offensive security methodologies, emphasizing the continuous evolution of evasion techniques. This development underscores the necessity for defensive strategies to adapt rapidly, as threat actors increasingly leverage sophisticated tools to bypass conventional security measures.
Why This Matters Now
The introduction of WasmForge signifies a pivotal shift in offensive security tactics, utilizing WebAssembly to circumvent traditional detection mechanisms. This evolution necessitates immediate attention from cybersecurity professionals to develop and implement advanced detection and response strategies capable of identifying and mitigating such sophisticated evasion techniques.
Attack Path Analysis
An attacker utilized WasmForge to compile the Sliver C2 framework into a WebAssembly module, enabling execution on a target system. This approach allowed the attacker to bypass traditional endpoint detection mechanisms, establish command and control channels, and potentially exfiltrate data or disrupt operations.
Kill Chain Progression
Initial Compromise
Description
The attacker delivered a WasmForge-compiled Sliver payload to the target system, exploiting the ability of WebAssembly modules to evade traditional static analysis and signature-based detection.
Related CVEs
CVE-2026-34227
CVSS 8.8A missing authentication vulnerability in Sliver C2 Framework allows unauthenticated attackers to hijack all active C2 sessions via malicious links.
Affected Products:
BishopFox Sliver C2 Framework – < 1.7.4
Exploit Status:
exploited in the wildCVE-2026-25760
CVSS 6.5A path traversal vulnerability in Sliver C2 Framework allows authenticated operators to read arbitrary files on the server.
Affected Products:
BishopFox Sliver C2 Framework – < 1.6.11
Exploit Status:
proof of conceptCVE-2026-25791
CVSS 7.5A denial of service vulnerability in Sliver C2 Framework allows unauthenticated attackers to exhaust server memory via DNS C2 listener.
Affected Products:
BishopFox Sliver C2 Framework – < 1.7.0
Exploit Status:
proof of conceptCVE-2026-32941
CVSS 6.5A remote out-of-memory vulnerability in Sliver C2 Framework allows attackers to crash the server by sending crafted messages.
Affected Products:
BishopFox Sliver C2 Framework – <= 1.7.3
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Reflective Code Loading
Virtualization/Sandbox Evasion
Masquerading
Obfuscated Files or Information
Command and Scripting Interpreter: PowerShell
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer/Network Security
WasmForge's offensive security tool development enables advanced evasion techniques, directly impacting security vendors' detection capabilities and requiring immediate signature updates.
Financial Services
WebAssembly-based attack vectors bypass traditional EDR solutions, threatening encrypted traffic monitoring and zero trust segmentation critical for financial institution compliance.
Information Technology/IT
IT service providers face elevated risks from polymorphic malware delivery, compromising multicloud visibility controls and east-west traffic security across client infrastructures.
Government Administration
Government agencies require enhanced threat detection capabilities against WebAssembly-compiled offensive tools that evade standard intrusion prevention and endpoint security measures.
Sources
- Enter the WasmForge: Compiling Sliver into WebAssemblyhttps://www.praetorian.com/blog/wasmforge-sliver-webassembly/Verified
- CVE-2026-34227: Sliver C2 Framework RCE Vulnerabilityhttps://www.sentinelone.com/vulnerability-database/cve-2026-34227/Verified
- CVE-2026-25760: Sliver C2 Path Traversal Vulnerabilityhttps://www.sentinelone.com/vulnerability-database/cve-2026-25760/Verified
- CVE-2026-25791: Sliver C2 Framework DoS Vulnerabilityhttps://www.sentinelone.com/vulnerability-database/cve-2026-25791/Verified
- CVE-2026-32941https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32941Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust Cloud Native Security Fabric (CNSF) is pertinent to this incident as it embeds security directly into the cloud infrastructure, potentially limiting the attacker's ability to move laterally and exfiltrate data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute the Sliver payload may have been constrained, reducing the likelihood of successful initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges may have been constrained, reducing the potential impact of the attack.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement within the network may have been constrained, reducing the scope of the attack.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels may have been constrained, reducing the effectiveness of remote control.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data may have been constrained, reducing the risk of data loss.
The attacker's ability to disrupt operations may have been constrained, reducing the potential impact on critical systems.
Impact at a Glance
Affected Business Functions
- Command and Control Operations
- Red Team Engagements
Estimated downtime: 7 days
Estimated loss: $50,000
Potential exposure of sensitive red team operational data, including credentials and reconnaissance information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement and limit the attacker's ability to access sensitive resources.
- • Deploy Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to unusual behaviors indicative of command and control activities.
- • Enforce East-West Traffic Security to monitor and control internal network communications, reducing the risk of lateral movement.
- • Apply Inline IPS (Suricata) to detect and prevent known exploit patterns and malicious payloads, enhancing overall network security.
