Skip to content

PING-007 v3.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 16:07
· 2 commits to stable since this release
v3.0.0
0012ebf

PING-007 v3.0.0

Covert ICMP C2 framework — encrypted data inside packets byte-for-byte identical to a real OS ping.

Every packet matches the exact payload structure, size, TTL, ICMP ID, and sequence start of a genuine Linux or Windows ping. Traffic is structurally indistinguishable from normal network diagnostics regardless of whether the observer has the key.

What's included

  • OS signature mimicry: exact Linux 64B (ping -s 56) and Windows 40B format
  • Three AEAD algorithms with per-session rotation: AES-256-GCM, ChaCha20-Poly1305, XOR-CFB-HMAC
  • PBKDF2-SHA256 (100 000 iterations) key derivation — no key material in the binary
  • File exfiltration: steganographic fragmentation across N×64B pings, each indistinguishable from ping -c 1
  • Bidirectional C2 shell over ICMP
  • APT timing profiles: Lazarus (5 min–1 hr), APT29 (30 min–2 hr), APT28 (10–30 min), Equation Group (1–3 days)
  • Sandbox detection, decoy pings, human timing, shell jitter
  • Build variants: standard / no-c2 / stealth / ghost / compressed / armored / all-platforms
  • 250 tests, -race clean

Downloads

Platform Archive
Linux x64 ping-007-linux-amd64.tar.gz
Linux ARM64 ping-007-linux-arm64.tar.gz
Windows x64 ping-007-windows-amd64.exe.zip
macOS x64 ping-007-darwin-amd64.tar.gz
macOS ARM64 ping-007-darwin-arm64.tar.gz 
# Linux / macOS
tar -xzf ping-007-linux-amd64.tar.gz
sudo ./ping-007-linux-amd64 --help

# Verify
sha256sum -c checksums.txt

Requires CAP_NET_RAW (Linux/macOS) or Administrator (Windows) for raw socket operations.

Authorized use only. Deploy against systems you own or have explicit written permission to test.

Full Changelog: https://github.com/franckferman/ping-007/commits/v3.0.0

Assets 8
Loading