---
id: 6298
title: "A Simple Approach to Discovering Oyster Backdoor Infrastructure"
source_domain: hunt.io
source_url: "https://hunt.io/blog/a-simple-approach-to-discovering-oyster-backdoor-infrastructure"
published_at: "2024-07-23T00:00:00Z"
tags: ["malware", "threat-hunting", "tls-certificates", "c2-infrastructure", "oyster-backdoor", "jarm"]
phying_url: "https://phying.com/item/6298"
lang: en
---

# A Simple Approach to Discovering Oyster Backdoor Infrastructure

## Summary

Hunt.io shows a simple hunting recipe for Oyster backdoor infrastructure—pivoting from Rapid7's domains via 'Soon.' HTML titles, body hashes and TLS certificate details to surface new C2 servers.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2024-07-23T00:00:00Z
- **Original:** https://hunt.io/blog/a-simple-approach-to-discovering-oyster-backdoor-infrastructure
- **Phying News:** https://phying.com/item/6298