Team Cymru Uses Network Telemetry to Identify Possible C2 Victims
Summary
Team Cymru says its Total Insights Feed can tag IPs that show sustained, high-confidence communication with known C2 infrastructure, giving defenders investigative leads—not definitive proof of compromise.
Key points
- The Total Insights Feed evaluates available NetFlow observations for sustained, high-confidence interactions with identified C2 infrastructure.
- Systems meeting analytic criteria may receive malware- or C2-family tags, such as “sliver-bot.”
- Organizations can check their IP ranges against the feed; analysts can use associated bot tags to investigate potential downstream victims.
- Team Cymru cautions that the tags are leads for validation and response, not proof of compromise.
- The capability combines network telemetry with open-port and service fingerprints, internet probes, infrastructure relationships, and analyst-developed detections.
Article Details
- Event Type
- Security intelligence capability for identifying possible victims communicating with command-and-control infrastructure
- Impact
- The Total Insights Feed uses network telemetry and behavioral tagging to identify systems that may have communicated with known malicious controllers, giving security teams investigative leads to prioritize validation, containment, and response. The tags are not definitive proof of compromise; their usefulness depends on sufficient telemetry visibility.