Hunt.io Details C2 Infrastructure Tracking Methods and Introduces Threat Feed
Summary
Hunt.io describes methods for identifying malicious C2 servers and introduces a JSON feed that uses internet scanning, focused monitoring, validation, and regularly updated signatures to provide near-real-time infrastructure intelligence.
Key points
- Hunt says it tracks 110 infrastructure families, 85 of which are active daily.
- Its researchers look for indicators including TLS certificates, HTTP headers, HTML strings, SSH keys, naming patterns, JARM and JA4 fingerprints, and TCP banners.
- A Gh0st RAT scanning example shows that a few bytes of random data can elicit the expected response, avoiding a custom packet.
- The article describes combining certificate and HTTP-response details to identify suspected ShadowPad infrastructure, rather than relying on one indicator.
- An Octopus C2 example uses HTML page content and HTTP response headers to build a query for identifying infrastructure.
- Hunt's C2 Feed provides JSON data from the previous seven days, generated in real time; the company says it uses broad scanning, increased monitoring of high-risk areas, validation, and weekly signature updates.
- The Octopus project is available at github[.]com/mhaskar/Octopus.
Article Details
- Defense Focus
- Identify and track malicious command-and-control infrastructure early so defenders can block it before it is used to deploy malware.
- Detection Methods
- Scan internet-facing servers for malware-related protocols, certificates, and other artifacts, with increased monitoring of previously high-risk areas.
- Identify suspicious infrastructure using TLS/SSL certificates, HTTP headers and responses, HTML strings, SSH keys, domain naming conventions, JARM and JA4x fingerprints, and TCP banners.
- Probe suspected Gh0st RAT servers with random data and check whether they return the expected response.
- Combine certificate fields with HTTP responses to identify suspected ShadowPad infrastructure; omit volatile Server and Date headers when querying for Octopus infrastructure.
- Validate suspected infrastructure using multiple factors, including hosting provider, location, historical and recent reporting, and third-party detections, to reduce false positives.
- Data Sources
- Internet scan results and server responses
- TLS/SSL certificates
- HTTP headers, responses, and HTML content
- SSH keys
- Domain naming conventions
- JARM and JA4x fingerprints
- TCP banners
- Blog posts, vendor reports, IOC databases, and third-party detections
- Rule Types
- JSON threat-intelligence feed
- Queries combining certificate fields with HTTP responses or HTML content
- Defensive Actions
- Use validated C2 infrastructure indicators to track or block malicious servers.
- Correlate multiple indicators rather than relying on a single certificate or other individual indicator.
- Keep malware signatures updated and use current threat-feed data to support focused investigations.
People
Malware
EmotetShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.Gh0st RATGh0st RAT (Remote Administration Tool) emerged into the public domain in 2008 and has continued its eerie presence with unrelenting momentum. With numerous variants and a recognizable network protocol, attackers haven'tHEADLACEShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.Quasar RATShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.ShadowPadShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.SIGNBTShadowPad, Quasar RAT, HeadLace, Emotet, and SIGNBT (to name a few) often grab headlines and captivate readers, leading to a long day of scouring logs and network traffic for blue teamers.
Vendors
Products
C2 Feedand insights. More precisely, this commitment to innovation has recently led to the development of C2 Feed, our latest effort in the near real-time identification of command and control (C2) frameworks. DesignedIOC HunterThis process could begin with a blog post or vendor report, an IOC database like Hunt's IOC Hunter (shameless plug), or through internet scanning.ThreatFoxThese tags are helpful, but many servers likely contain similar messages. We can use IOC Hunter or ThreatFox to find a few verified Octopus servers to gather additional information for detection..