Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How We Identify Malicious Infrastructure At Hunt.io

hunt.io | blog | #threat-hunting | #c2 | #methodology | #tls-certificates | #malware-infrastructure

Summary

Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Gh0st and Pantegana: Two RATs that Refuse to Fade Away
Hunt examines current infrastructure for two RATs: the long-lived Gh0st, detected via its 'Gh0st' packet flag, and the newer Go-based Pantegana, which uses customized certificates to evade scanners.
blog · hunt.io
Tracking ShadowPad Infrastructure Via Non-Standard Certificates
Hunt found 30+ ShadowPad servers using a certificate spoofing Dell's 'Data Vault', with two suspected clusters showing why non-standard certificates uncover fresh infrastructure.
blog · netlas.io
How we hunt C2 infrastructure at RST Cloud using Netlas
How RST Cloud hunts C2 infrastructure with Netlas: a seven-step loop from goals and samples to fingerprints (JARM, certificates, HTTP headers), scheduled searches and multi-criteria validation.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Geacon and Geacon_Pro: A Constant Menace to Linux and Windows Systems
Hunt tracked Geacon_Pro, a Golang Cobalt Strike implementation, via its default 'foren.zik' TLS certificate, surfacing servers and open directories used against Linux and Windows hosts.
blog · hunt.io
Introducing the Hunt.io C2 Feed
Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.
back