Open-Source Attack Tools Are Going Mainstream. The Barrier to Hacking Your Business Is Now Zero.

#The tools that hacked a bank are free on GitHub.

In late May 2026, researchers documented a campaign targeting Brazilian financial institutions, fintech companies, and cryptocurrency platforms. The attackers used trojanized software installers and phishing emails disguised as judicial summons to get inside. Once in, they deployed a command-and-control framework called Sliver to maintain persistent access, monitor banking sessions in real time, steal credentials through browser overlays, and extract SSH keys and cloud tokens.

That's a professional-grade operation. Persistent access. Real-time fraud. Credential harvesting. The kind of campaign you'd expect from a well-funded threat group.

Sliver is free. It's open source. It's on GitHub. The documentation includes tutorials.

#This isn't about Brazil. This is about the barrier to entry.

The Brazil campaign matters, but not because you're a Brazilian bank. It matters because the tools used to execute it are available to literally anyone.

Five years ago, running a command-and-control framework required either building your own infrastructure from scratch or buying expensive commercial tools on criminal marketplaces. The skill floor was high. The cost was real. That limited the pool of people who could run this kind of operation.

That's over.

Sliver is a legitimate open-source security tool built in Go. It supports encrypted communications over multiple protocols. It handles process injection, lateral movement, and persistent implants. It was designed for authorized red team engagements, and it's excellent at that job. It's also excellent at everything an attacker needs it to do.

And Sliver is just one example. The open-source offensive security ecosystem now includes frameworks for phishing, credential harvesting, post-exploitation, privilege escalation, and data exfiltration. All free. All documented. All actively maintained.

The barrier to running a professional-grade attack campaign against your business is now zero dollars and a weekend of reading documentation.

#Why this changes the threat model for small businesses.

If you're a 30-person company in Chicago, your old mental model probably looked like this: "We're too small to be targeted. The real hackers go after banks and hospitals."

That model assumed attacking you required effort and investment. It assumed the attacker had to choose you specifically and dedicate resources to compromising your environment.

Open-source attack tooling demolishes that assumption. When the tools are free and the playbooks are public, attackers don't need to choose you. They can spray campaigns across thousands of targets and see what sticks. The 600 firewalls compromised in a single wave weren't individually targeted. They were scanned, tested, and looted at industrial scale because the tools made it trivial.

The same economics apply here. An attacker with Sliver and a phishing kit can target your business with the same tooling and tradecraft that hit Brazilian banks. They don't need your industry knowledge. They don't need your internal documentation. They need your employees to click a link, and after that, the framework handles the rest.

#What the attack actually looks like.

Here's how a Sliver-based campaign works against a small business. No theory. This is the playbook.

Step 1: Initial access. A phishing email lands in someone's inbox. Maybe it looks like a court notice, a vendor invoice, or a Microsoft 365 session expiry. The email contains an attachment or link that drops a small executable.

Step 2: Implant phones home. The executable is a Sliver implant. It establishes an encrypted connection back to the attacker's server using mutual TLS, DNS tunneling, or HTTPS -- whatever gets through your firewall. From the outside, the traffic looks like normal web browsing.

Step 3: Persistent access. The attacker now has a remote shell on the compromised machine. They can execute commands, upload and download files, take screenshots, log keystrokes, and move laterally to other systems on the network. The implant survives reboots.

Step 4: Credential harvesting. The attacker dumps cached credentials, extracts browser-stored passwords, steals SSH keys, and pulls cloud service tokens. If your team reuses passwords, one compromised workstation gives the attacker access to everything that password touches.

Step 5: Objective. Whatever the attacker wants. Ransomware deployment. Wire fraud. Data exfiltration. Cryptomining. Access sold to another group. The implant gives them the access. What they do with it depends on what's profitable.

The entire chain from phishing email to full network access can take hours, not days.

#"But we have antivirus."

Sliver is written in Go and compiles to a single binary. It's trivially customizable. Attackers recompile it with different configurations, different encryption keys, different communication patterns. Each build produces a unique binary that signature-based antivirus has never seen before.

Your antivirus is looking for known bad files. A freshly compiled Sliver implant is not a known bad file. It's a brand-new binary that's never existed before.

EDR (endpoint detection and response) is better. Good EDR can detect the behavior -- process injection, unusual outbound connections, credential access patterns -- even if it's never seen the specific binary. But most small businesses don't have EDR. They have antivirus. And antivirus is not enough anymore. If your IT guy is your entire security team, the gap between what you have and what you need is getting wider every month.

#What to do.

1. Deploy application allowlisting. Instead of trying to block every bad program (impossible), only allow known good programs to run. Windows has AppLocker built in. If an executable isn't on the approved list, it doesn't run. This stops the Sliver implant from executing even if an employee downloads it.

2. Upgrade from antivirus to EDR. Endpoint detection and response tools like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint detect behavior, not just signatures. They catch the process injection and anomalous network connections that Sliver uses. Some options are available at price points accessible to small businesses.

3. Train your people on phishing. The entire attack chain starts with someone clicking a link or opening a file. Regular, realistic phishing simulations build the instinct to pause and verify. Not annual compliance training. Monthly exercises with real scenarios.

4. Monitor for unusual outbound connections. Sliver communicates over encrypted channels to external servers. DNS monitoring and outbound traffic analysis can flag connections to infrastructure that doesn't match your normal business traffic. If a workstation is making mTLS connections to an IP address in a country you don't do business with, that's a signal.

5. Segment your network. If an attacker compromises one workstation, can they reach your file server? Your accounting system? Your domain controller? Network segmentation limits lateral movement. One compromised machine should not equal a compromised network.

6. Assume compromise and hunt. If you haven't looked for indicators of compromise in your environment, you don't know whether you're clean. You know that you haven't looked. Schedule regular threat hunts or hire someone to look for you. The attackers using these tools are good at being quiet.

7. Build an actual security program. Not antivirus plus hope. A real program with policies, monitoring, incident response procedures, and regular assessment. If you can't describe your security posture in concrete terms right now, you don't have one.

#The playing field just leveled. Not in your favor.

The attackers who hit Brazilian banks didn't need a budget. They needed a GitHub account and a phishing template. The same tools, the same techniques, and the same playbooks work against a 15-person law firm in the Loop, a medical practice in Hyde Park, or a restaurant group in Wicker Park.

The sophistication gap between nation-state attacks and commodity cybercrime is collapsing. The tools are the same. The only difference is who's using them and what they want.

Your defenses need to reflect that reality. Not the threat landscape from 2020. The one from right now.

#Further reading

• Elastic Security Labs: TCLBANKER - technical analysis of the Brazilian banking trojan campaign
• Cybereason: Sliver C2 - how threat actors are leveraging Sliver
• BishopFox Sliver - the open-source C2 framework (know what you're defending against)
• CISA: Open Source Security - federal guidance on open-source security risks
• MITRE ATT&CK: Command and Control - the tactical framework for understanding C2 techniques