Sandman

Sandman is a C# backdoor/stager paired with a Python 3.9 Scapy server. It uses custom NTP messages to retrieve and run a configured payload; its optional Windows Time Provider component can establish persistence, and the project documents shellcode injection into RuntimeBroker.exe. It may blend into networks where UDP/123 is permitted, but NTP use does not ensure firewall bypass or stealth.