Curated security research, vulnerabilities, advisories and tools for practitioners.

#c2

Security coverage tagged c2.

1.

From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion

blog | 2026-09-18 00:00 | bishopfox.com | Original ↗ | .md | #red-team | #obfuscation | #c2

2.

SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia

research | 2026-09-16 00:00 | hunt.io | Original ↗ | .md | #threat-intelligence | #apt | #c2

3.

BOFScale: A CDN-Fronted Tailnet from a BOF-PE

blog | 2026-08-19 00:00 | netspi.com | Original ↗ | .md | #red-team | #c2 | #cdn

4.

The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

blog | 2026-08-04 00:00 | hunt.io | Original ↗ | .md | #web3 | #threat-intelligence | #ransomware

5.

CVE-2026-9198: Langflow OSS Unauthenticated Remote Code Execution Exploit

vulnerability | Critical | 2026-07-21 11:14 | CVE-2026-9198 | github.com | Original ↗ | .md | #ai-security | #rce | #red-team

6.

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

research | 2026-05-14 00:00 | hunt.io | Original ↗ | .md | #supply-chain | #threat-intelligence | #malware

7.

Introducing Joro: Using AI to Build Security Tooling

tool | 2026-05-12 00:00 | bishopfox.com | Original ↗ | .md | #ai-security | #offensive-security | #c2

8.

How we hunt C2 infrastructure at RST Cloud using Netlas

blog | 2026-03-20 00:00 | netlas.io | Original ↗ | .md | #cloud | #threat-intelligence | #threat-hunting

9.

The Complete Guide to Hunting Cobalt Strike - Part 4: Operationalizing C2 Feeds with API Automation

blog | 2026-03-03 00:00 | hunt.io | Original ↗ | .md | #threat-intelligence | #threat-detection | #detection-engineering

10.

Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment

blog | 2026-01-28 00:00 | hunt.io | Original ↗ | .md | #attack-chains | #malware | #threat-hunting

11.

The Complete Guide to Hunting Cobalt Strike - Part 3: Automated C2 Infrastructure Discovery

blog | 2026-01-06 00:00 | hunt.io | Original ↗ | .md | #threat-detection | #threat-hunting | #c2

12.

Announcing Hunt 2.8: Sharper IOC Hunter Workflows, Smarter Provider Visibility, and Easier C2 Filtering

blog | 2025-12-18 00:00 | hunt.io | Original ↗ | .md | #threat-intelligence | #threat-hunting | #phishing

13.

The Evolution of C2: Centralized to On-Chain

blog | 2025-12-12 00:00 | netlas.io | Original ↗ | .md | #web3 | #threat-intelligence | #malware

14.

The Complete Guide to Hunting Cobalt Strike - Part 2: 10+ HuntSQL Recipes to Find Cobalt Strike

blog | 2025-11-19 00:00 | hunt.io | Original ↗ | .md | #threat-detection | #threat-hunting | #c2

15.

The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories

blog | 2025-11-13 00:00 | hunt.io | Original ↗ | .md | #threat-hunting | #c2 | #cobalt-strike

16.

AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies

research | 2025-10-09 00:00 | hunt.io | Original ↗ | .md | #threat-hunting | #c2 | #malware-analysis

17.

TinyLoader Malware: Crypto Theft & C2 Infrastructure

blog | 2025-09-02 00:00 | hunt.io | Original ↗ | .md | #malware | #cryptocurrency | #c2

18.

Proactive Threat Hunting: Techniques to Identify Malicious Infrastructure

blog | 2025-07-30 00:00 | netlas.io | Original ↗ | .md | #threat-hunting | #c2 | #detection

19.

Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

blog | 2025-07-22 00:00 | hunt.io | Original ↗ | .md | #phishing | #macos | #c2

20.

CVE-2025-4660: Forescout SecureConnector RCE

vulnerability | 2025-07-16 00:00 | CVE-2025-4660 | netspi.com | Original ↗ | .md | #rce | #red-team | #c2

21.

Cobalt Strike Operators Leverage PowerShell Loaders Across Chinese, Russian, and Global Infrastructure

blog | 2025-06-19 00:00 | hunt.io | Original ↗ | .md | #cloud | #c2 | #powershell

22.

2025 Red Team Tools – C2 Frameworks, Active Directory & Network Exploitation

blog | 2025-06-04 00:00 | bishopfox.com | Original ↗ | .md | #active-directory | #red-team | #c2

23.

Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure

blog | 2025-06-05 00:00 | hunt.io | Original ↗ | .md | #obfuscation | #c2 | #asyncrat

24.

RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

blog | 2025-05-06 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #malware | #npm

25.

Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

blog | 2025-04-08 00:00 | hunt.io | Original ↗ | .md | #c2 | #state-sponsored | #gamaredon

26.

Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 2)

blog | 2025-03-20 04:12 | blog.viettelcybersecurity.com | Original ↗ | .md | #apt | #c2 | #cdn

27.

Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 2)

blog | 2025-03-20 03:43 | blog.viettelcybersecurity.com | Original ↗ | .md | #apt | #c2 | #cdn

28.

The Things We Think and Do Not Say: The Future of Our Beacon Object Files (BOFs)

blog | 2025-03-19 00:00 | netspi.com | Original ↗ | .md | #red-team | #c2 | #cobalt-strike

29.

Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure

blog | 2025-02-27 00:00 | hunt.io | Original ↗ | .md | #cloud | #c2 | #ssl-certificates

30.

Tracking Pyramid C2: Identifying Post-Exploitation Servers in Hunt

blog | 2025-02-12 00:00 | hunt.io | Original ↗ | .md | #python | #c2 | #post-exploitation