Researchers Detail Tuoni C2's Role in an Attempted 2025 Real-Estate Cyber Intrusion

Cybersecurity researchers have detailed a mid-October 2025 attack against a major U.S.-based real-estate company that used a nascent command-and-control framework known as Tuoni. According to Morphisec researcher Shmuel Uzan, the campaign leveraged the Tuoni C2 framework to deliver stealthy, in-memory payloads, with a Community Edition of the tool freely available for download.

Initial access was likely gained via social engineering using Microsoft Teams impersonation to persuade an employee to run a PowerShell command, with the downloaded second script then embedding a payload through steganography inside a BMP image; the embedded payload was designed to extract shellcode and execute it in memory.

The resulting TuoniAgent.dll acted as an agent on the compromised machine, connecting to a C2 server at kupaoquan[.]com to enable remote control, a process Morphisec notes showed signs of AI assistance in initial loader code generation. Although the attack failed, the researchers emphasise a continued misuse of red-teaming tools for malicious purposes, alongside other AI-driven exploitation developments noted in September 2025, such as HexStrike AI.