Ethereum Blockchain Platform
Ethereum is a blockchain platform used in the EtherHiding technique of the DPRK malvertising campaign. Malware extracts C2 server addresses from Ethereum…
Tag: C2
Go2Tunnel: Remote Access and Network Tunneling Tool
Go2Tunnel is a tool used by Armored Likho for remote access and network tunneling, establishing reverse SSH tunnels to C2 servers. It…
Mapbox: Mapping Platform Used for C2 Communication
Mapbox is a legitimate mapping service that was abused by ChocoPoC as a dead drop for command and control, using domain-fronting to…
PteroEffigy: Gamaredon C2 Tool Using GoFile
PteroEffigy is a tool used by Gamaredon to fetch the command-and-control server using the GoFile cloud storage service.
GoFile: Cloud Storage Service
GoFile is a cloud storage service used by Gamaredon for C2 server discovery via PteroEffigy.
Microsoft Removes 119 Edge Extensions Hiding Malware in Images and Fonts
Microsoft has removed 119 malicious extensions from the Edge Add-ons store that used steganography to hide malware in image and font files.…
Edge Browser: Headless Mode for C2 Transport
TWINLOOT launches the victim's Edge browser in headless mode and uses CDP to ferry Graph API traffic, making it indistinguishable from legitimate…
Cloudflare Workers: Abused for C2 Proxy in PINHOLE RAT
Cloudflare Workers is a serverless execution environment that is being abused by PINHOLE RAT to proxy C2 communication. The malware uses high-reputation…
Socket.IO: Real-Time Communication Library Used in Malware C2
A JavaScript library for real-time web applications, exploited by OtterCookie as a command-and-control communication channel.
SoftEther VPN: Open-Source VPN Used by Attackers
SoftEther VPN is an open-source VPN solution that has been co-opted by threat actors like CL-STA-1062 to establish encrypted tunnels for command…