Hunt IO Shares Network Signatures for Detecting Pyramid C2 Servers
Summary
Hunt IO describes HTTP response patterns and a query to identify Pyramid C2 servers, reporting nine matching IP addresses. Three overlapped with infrastructure previously linked to a RansomHub affiliate’s Python-based backdoor.
Key points
- Pyramid is an open-source Python post-exploitation framework whose HTTP/S server can deliver encrypted payloads and support command-and-control.
- Its unauthenticated responses may include HTTP 401, a distinctive JSON error body, a Basic authentication realm, and a BaseHTTP/Python server header.
- Hunt IO combined these indicators into a structured query and identified nine matching IP addresses across several ports.
- Three matching IPs had previously appeared in GuidePoint Security reporting on a Python-based backdoor associated with a RansomHub affiliate.
- Hunt IO noted that one other server resolved to recently registered domains resembling a Polish marketing service, but found no associated malicious samples.
- The article presents the indicators as a way for defenders to identify and monitor potentially related infrastructure; the findings do not confirm that every matching server is malicious.
Article Details
- Defense Focus
- Identify and monitor Pyramid post-exploitation servers using distinctive HTTP response patterns.
- Detection Methods
- Search for HTTP 401 responses with the specified response-body SHA-256, a BaseHTTP/0.* Python/3.* server header, WWW-Authenticate: Basic realm="Demo Realm", and Content-Type: application/json.
- Validate candidate servers by checking that the headers match the expected JSON error response: { "success": false, "error": "No auth header received" }.
- Track matching servers over time and monitor or preemptively block suspect IP addresses.
- Data Sources
- HTTP status codes
- HTTP response-body content and SHA-256 hash
- HTTP Server, WWW-Authenticate, and Content-Type headers
- Observed server IP addresses and associated domains
- Rule Types
- Structured HTTP search query combining status, response-body hash, server-header pattern, and authentication/content headers
- Platforms
- Hunt
- Defensive Actions
- Use the combined response characteristics to identify and validate likely Pyramid servers while reducing false positives.
- Monitor identified infrastructure and consider blocking suspect IP addresses before they are used in attacks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | emdr-traumatherapie[.]info | Domain listed in the article's indicators table as associated with the identified server at 38.180.195[.]187. |
| DOMAIN | thiscode[.]info | Domain listed in the article's indicators table as associated with the identified server at 38.180.195[.]187. |
| IPV4 | 104[.]238[.]61[.]144 | Address identified by the authors as a Pyramid-related server and previously listed in GuidePoint Security's RansomHub analysis as associated with a Python-based backdoor. |
| IPV4 | 15[.]222[.]251[.]55 | Listed in the article's network observables and indicators table among identified Pyramid-related infrastructure. |
| IPV4 | 162[.]252[.]172[.]12 | Listed in the article's network observables and indicators table among identified Pyramid-related infrastructure. |
| IPV4 | 38[.]146[.]28[.]93 | Listed in the article's network observables and indicators table among identified Pyramid-related infrastructure. |
| IPV4 | 38[.]180[.]195[.]187 | Listed in the article's network observables and indicators table among identified Pyramid-related infrastructure. |
| IPV4 | 45[.]82[.]85[.]50 | Address identified by the authors as a Pyramid-related server and previously listed in GuidePoint Security's RansomHub analysis as associated with a Python-based backdoor. |
| IPV4 | 54[.]38[.]94[.]225 | Address identified as a Pyramid-related server; the authors had not identified malicious samples associated with it. |
| IPV4 | 85[.]208[.]139[.]131 | Listed in the article's network observables and indicators table among identified Pyramid-related infrastructure. |
| IPV4 | 92[.]118[.]112[.]208 | Address identified by the authors as a Pyramid-related server and previously listed in GuidePoint Security's RansomHub analysis as associated with a Python-based backdoor. |
| SHA256 | 54477efe7ddfa471efdcc83f2e1ffb5687ac9dca2bc8a2b86b253cdbb5cb9c84 | SHA-256 hash of the HTTP response body used as a Pyramid-server detection observable. |
MITRE ATT&CK
T1059.006 · PythonPyramid is a Python-based post-exploitation server and uses a Python interpreter to run its activity.T1071.001 · Web ProtocolsPyramid communicates with its server over HTTP or HTTPS for command-and-control.T1105 · Ingress Tool TransferThe Pyramid server delivers files and encrypted payloads to its agent.
Threat Actors
Malware
Products
Cobalt StrikeIn December 2024, The DFIR Report published a blog post on TA4557 (also referred to as FIN6) activity leveraging Cobalt Strike and Pyramid to target job seekers with the more_eggs malware.Pyramidexecution are frequently shared, making it easier for threat actors to repurpose them for malicious use. Pyramid, an open-source post-exploitation framework written in Python, is one such tool. Among its features is a
Tools
BloodHoundScreenshot of Pyramid README.The project ships with several modules that load well-known programs like BloodHound, secretsdump, and LaZagne directly into memory. This in-memory execution allows operators to act withinLaZagneproject ships with several modules that load well-known programs like BloodHound, secretsdump, and LaZagne directly into memory. This in-memory execution allows operators to act within the context of a signedsecretsdumpPyramid README.The project ships with several modules that load well-known programs like BloodHound, secretsdump, and LaZagne directly into memory. This in-memory execution allows operators to act within the context