Cybersecurity researchers have recently discovered a new red-teaming tool – “Splinter”- lurking on compromised systems post-incident. Splinter is similar to the well-known post-exploitation tool Cobalt Strike, but less advanced. Researchers dub the tool “Splinter” based on the internal project name spotted in a debugging artifact in its code. It is not yet known who developed Splinter or which threat groups have been attributed to its misuse. Splinter is developed in Rust, and its samples are very large due to the number of external libraries the file uses. Splinter uses a JSON format for its configuration data which contains the implant and targeted endpoint identifiers as well as the command-and-control (C2) server details. Splinter connects to its C2 server over HTTPS. Splinter’s capabilities include running Windows commands, remote process injection, file uploads and downloads, information harvesting, and self-destructing. Splinter is a red team tool, which when used as intended provides adversary simulation frameworks that allow organizations to test and improve their defenses. CTIX analysts reported earlier this month on another red team tool “MacroPack” that is being used by threat actors to escalate privileges and download malware on victim machines. These two developments this month indicate that threat actors are using different post-exploitation tools likely in the attempt to evade detection as Cobalt Strike has notoriously been used by threat actors for malicious purposes. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.