Skip to content
Threat Feed
Subscribe

Tag

T1027

1 brief RSS
high threat

TinyCC Masquerading as Svchost for Shellcode Execution

Attackers rename TinyCC (tcc.exe) to svchost.exe and use it to compile and execute C source files containing shellcode, using the `-nostdlib` and `-run` flags, as observed in the Lotus Blossom Chrysalis backdoor campaign, indicating potential evasion and malicious code execution.

Tiny C Compiler Lotus Blossom tinycc shellcode svchost lotus-blossom chrysalis t1059.003 t1027
2r 2t