Tracking ShadowPad Infrastructure Via Non-Standard Certificates

Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.

Hunt examines current infrastructure for two RATs: the long-lived Gh0st, detected via its 'Gh0st' packet flag, and the newer Go-based Pantegana, which uses customized certificates to evade scanners.

Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.

Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.

Hunt shows proactive hunting: pivoting on certificate names from Microsoft's Flax Typhoon report yielded four unreported SoftEther servers, plus Cobalt-related files found via keyword search.

How open directories aid threat hunting and incident response: exposed C2 executables, configs, bash history and RAT logs can reveal victims; Hunt automates finding and pivoting on them.