Stealthy EX-22 post-exploitation tool linked to LockBit ransomware
Dubbed EXFILTRATE-22 or EX-22, the framework was built using the leaked source code of other post-exploitation frameworks with the same command-and-control infrastructure and "domain fronting" technique as LockBit 3.0.