Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure

Scott Sutherland releases SQLC2, a PowerShell PoC using SQL Server, including Azure SQL, as both controller and agent for C2, blending into permitted *.database.windows.net traffic on port 1433.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.

SSL intelligence—certificate issuers, validity and reuse patterns—exposes malicious infrastructure; Hunt.io cites KeyPlug/GhostWolf and Cyberhaven cases where certificate history revealed C2 servers.

Hunt.io uses SSL history to tie a certificate to the Cyberhaven extension compromise, connecting its C2 servers to a wider campaign against Facebook ad accounts via fast-rotating Let's Encrypt certs.

Hunt uncovered SpyNote Android spyware samples in open directories, disguised as Google Translate, Temp Mail and Deutsche Postbank apps, detailing how the leaked spyware steals user data.