Internet Scans Find 34 Yakit Instances Alongside Cobalt Strike and Other Red-Team Tools
Summary
Hunt IO identified 34 internet-facing Yakit instances and found some infrastructure also hosted ARL, Cobalt Strike, Cobalt Strike Cat, or SuperShell. The article cautions that Yakit use alone does not indicate malicious activity.
Key points
- Hunt IO found 34 unique IP addresses running Yakit; most observed instances used port 8087.
- Default TLS certificates on Yakit servers can help identify instances, but scans may miss those using replacement certificates.
- One Yakit-associated server used a wildcard certificate for chinaunicom[.]xyz, which the article says likely spoofed the telecommunications company.
- The researchers found Cobalt Strike infrastructure using watermarks 987654321 and 391144938; the latter has been linked by security vendors to malicious activity, including HsHarada/Rapture ransomware.
- Some observed IPs also hosted ARL, mitmproxy, SuperShell, or possible Cobalt Strike Cat servers.
- The researchers note that Yakit and related red-team tools may be used legitimately; their presence alone does not establish malicious activity.
Article Details
- Attack Vectors
- Internet-exposed Yakit Team Servers and interception servers were identified during scans; the article notes that their presence does not necessarily indicate malicious activity.
- A SuperShell C2 server was observed listening on port 8888.
- Cobalt Strike team servers and Cobalt Strike Cat servers were observed alongside Yakit infrastructure.
- Defensive Notes
- Monitor internet-facing infrastructure for Yakit instances, including instances using default TLS certificates; operators may replace those certificates.
- Use certificate and port history to investigate infrastructure that shares certificates or configurations with observed servers.
- Treat Yakit and related tool presence as a lead for investigation, not by itself as evidence of malicious activity.
Malware
Vendors
Products
YakitIn our previous post on the Viper framework, we briefly covered the Yakit Security tool, which is publicly available on GitHub. In this post, we'll discuss its features and cover additional red team tools co-hosted withYaklangon GitHub in late 2021, the Yakit developers describe the tool as an "all-in-one platform based on Yaklang," a cybersecurity domain-specific language that offers man-in-the-middle interception capabilities, web
Tools
ARLfor legitimate purposes. Below, we'll examine some additional tools we found alongside Yakit, including ARL, Viper, SuperShell, Cobalt Strike (CS) with watermarks associated with malicious operations, and a fewCobalt Strikewe'll examine some additional tools we found alongside Yakit, including ARL, Viper, SuperShell, Cobalt Strike (CS) with watermarks associated with malicious operations, and a few Cobalt Strike Cat servers.Cobalt Strike CatSuperShell, Cobalt Strike (CS) with watermarks associated with malicious operations, and a few Cobalt Strike Cat servers.mitmproxyIn addition to Cobalt Strike, these IP addresses hosted ARL and mitmproxy, an open-source HTTPS proxy.SuperShellpurposes. Below, we'll examine some additional tools we found alongside Yakit, including ARL, Viper, SuperShell, Cobalt Strike (CS) with watermarks associated with malicious operations, and a few Cobalt Strike CatViperIn our previous post on the Viper framework, we briefly covered the Yakit Security tool, which is publicly available on GitHub. In this post, we'll discuss its features and cover additional red team tools co-hosted with