#c-2 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #c-2, aggregated by home.social.
-
Before Iran war, Army NETCOM transferred network and C2 services between theaters for first time
AUGUSTA, Ga. — Before Operation Epic Fury, the Army’s Network Enterprise Technology Command transferred digital services across theaters…
#NewsBeep #News #BreakingNews #armynetcom #armyunifiednetwork #breakingnews #c2 #Iran #iranwar #OperationEpicFury
https://www.newsbeep.com/705807/ -
-
Одно лишнее if — и объект уезжает в кучу: как C2 решает, каким аллокациям не быть
Пара new в горячем методе может вообще не попасть в кучу — а после безобидного if внезапно вернуть аллокации обратно. Разбираемся, как C2 принимает такие решения, где ломается скалярная замена и как проверить всё это через JMH и диагностические флаги JVM. Разобраться в JVM
https://habr.com/ru/companies/otus/articles/1068474/
#Java #JVM #HotSpot #C2 #Escape_Analysis #скалярная_замена #JITкомпиляция #аллокации_памяти #оптимизация_производительности #JMH
-
validx[.]shop looked fine at first glance. "Normal" name servers, a real mail setup, nothing that immediately stood out at the apex level. One subdomain didn't quite fit, though. It was getting DNS queries that were absurdly long and frequent for a new domain that nobody was really visiting. Rather than that being web traffic, we detected it as likely tunneling.
Turns out it wasn't a one-off. The same setup shows up on hundreds of other domains.
The domain names follow a similar pattern: short, brandable and portmanteau-y (i.e., cordkit, zenithly, queuebox), spread across a long list of cheap gTLDs with the same registrar.
The tunnel itself is answering with TXT records like:
⚠️ "H2;n=5;k=3;ol=2004;sz=800;cz=gz"
As best as we can tell, that's a shard count, a reconstruction threshold, a length, a chunk size, and a compression flag. We checked the signature against a number of known DNS tunnelling tools and none of them write a header like this.
We watched two more domains get registered mid-investigation, hours apart, which was fun to see and immediately block :ablobcatpopcorn:
We've got the infrastructure and the method. We haven't got a payload, and we haven't matched this header format to anything documented publicly.
Has anyone else run into this, recognize the TXT format above, or have a sample of a possible malware source? We'd like to hear from you.
⛔ validx[.]shop
⛔ cordkit[.]online
⛔ zenithly[.]best☠️ 95[.]179[.]159[.]229
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #c2
-
I'm currently implementing a feature into my threat intelligence workflow that will send the malware files and payloads I have collected to ‘abuse.ch’, and the download URLs and IP addresses controlled by attackers to ‘URLhause’.
-
MVG nimmt letzten C2-Zug für Münchner U-Bahn in Betrieb
#Bayern #C2 #Fahrzeugflotte #MVG #München #Nahverkehr #SWM #SiemensMobility #Siemens #UBahn #ÖPNV
https://bahnblogstelle.com/259333/mvg-nimmt-letzten-c2-zug-fuer-muenchner-u-bahn-in-betrieb/ -
----------------
🎯 Threat Intelligence
===================Group-IB Threat Intelligence has identified HOLLOWGRAPH, a .NET NativeAOT-compiled DLL malware attributed with high confidence to the Cavern backdoor framework. The malware transforms Microsoft 365 calendars into covert command-and-control channels using the Microsoft Graph API, communicating through a compromised Israeli mailbox.
🔹 Technical Overview
HOLLOWGRAPH operates with only two commands: get and send. Both execute exclusively through trusted Microsoft cloud infrastructure. The malware never reaches out directly to attacker-owned servers. Instead, it uses the Microsoft Graph API to treat a compromised mailbox's calendar as a two-way dead-drop.
🔹 C2 Mechanism
The calendar-based C2 works as follows:
1. Tasking: Operators plant calendar events containing encrypted commands as attachments.
2. Exfiltration: The implant creates its own calendar events with encrypted stolen data attached as files.
3. Concealment: Every event is dated to 13 May 2050, ensuring the mailbox owner is unlikely to notice them.All Graph payloads use hybrid RSA + AES encryption. Two separate key pairs keep tasking and exfiltration channels cryptographically independent.
🔹 Credential Renewal Channel
HOLLOWGRAPH maintains a secondary communication channel through DNS tunneling. It performs IPv6 AAAA record queries against the attacker-controlled domain cloudlanecdn[.]com to refresh its Microsoft Entra ID (Azure AD) credentials. Updated values are written to an on-disk configuration file named logAzure.txt.
This dual-channel architecture provides resilience. Even if the primary Graph API channel is disrupted, the malware can continue receiving refreshed authentication tokens through DNS.
🔹 Victimology
Group-IB identified 12 systems carrying the implant. Only approximately three were actively communicating with attacker infrastructure. The recovered indicators, an Israeli mailbox used for exfiltration and malware samples uploaded from Israel, suggest focused interest in Israeli entities rather than broad opportunistic compromise.
🔹 Detection Considerations
Defenders monitoring Microsoft 365 environments should look for:
• Calendar events with future dates far beyond typical scheduling horizons (e.g., 2050)
• Unusual file attachments on calendar entries
• DNS queries to cloudlanecdn[.]com with AAAA record types
• The on-disk artifact logAzure.txt
• Authentication patterns from .NET NativeAOT binaries interacting with Microsoft Graph API🔹 Attribution
Group-IB links HOLLOWGRAPH to the Cavern backdoor framework with high confidence, based on code and behavioral similarities with known Cavern components.
🔹 HOLLOWGRAPH #ThreatIntelligence #C2 #Microsoft365 #MalwareAnalysis
🔗 Source: https://www.group-ib.com/blog/hollowgraph-microsoft-365/
-
#TechnicalTalk
Adversary Village at @defcon 34!
Mauro Eldritch and Nelson Rafael Colón Merán from Bitso will be speaking on “Haetae: An Agent to Takedown North Korean C2 Servers” on 7 Aug 2026 at @defcon Creator Stage 3.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session and speakers:
https://adversaryvillage.org/adversary-events/DEFCON-34/Mauro-Eldritch/
https://adversaryvillage.org/adversary-events/DEFCON-34/Nelson-Rafael/
#AdversaryVillage #DEFCON34
#TechnicalTalk #ThreatActors #NorthKorea #AdversaryIntelligence
#Malware #C2 -
Several C2 (Command and Control) use case, I didn't realize Counter Strike can also be a C2.
Credit: @hackers_arise
https://hackers-arise.com/living-off-the-land-creative-c2-and-data-exfiltration-options/
-
Как я инфру в буткемпе на Standoff365 проходил [Infra 1] — [Infra 12]
Изначально хотел написать каждый пост для отдельного задания в инфре, но некоторые задания настолько короткие, что писать там даже особо нечего, тем более подсказки в буткемпе очень сильно облегчают решение. Начнем с первой инфры.
https://habr.com/ru/articles/1043364/
#standoff_365 #ctf #infrastructure #windows #activedirectory #kerberoasting #impacket #hash #c2 #adaptix
-
Another Telegram (Mobile) based Command and Control Demonstration (Featuring TeleTunnel v2)
-
Python C2 Server for Red Teaming: A Comprehensive Hands-On Guide
In this guide, I walk through building a Python-based C2 server, covering its architecture, encrypted communication, and real-world operational workflow.
https://denizhalil.com/2025/12/15/python-c2-server-red-teaming-guide/#CyberSecurity #RedTeam #C2 #commandandcontrol #Python #offensivesecurity #Pentesting #infosec #threatdetection #blueteam #securityengineering #ethicalhacking
-
Una vegada acabada l’experiència prova #C2 de català, aquí van les meves impressions:
Val la pena consultar a l’organisme a través del qual et vas inscriure quin model de prova fan servir. Jo ho vaig demanar on no tocava i vaig acabar estudiant amb un model més fàcil i més curt. -
Как я собрал себе C2 на малинке за один вечер
Давно хотел поднять свой C2-сервер. Ну, чтобы как большие мальчики с доменом, прокси, шифрованным туннелем. Но покупать VPS с 8GB RAM и платить за Cobalt Strike как‑то жирновато. Решил: будет малинка. ВНИМАНИЕ: Эта статья предназначена для ознакомления начинающим исследователям в области Кибербезопасности. Я не предоставляю инструкций по атакам на инфраструктуру. Я не буду тут показывать как обходить защиту windows и какие либо системы обнаружения угроз. Перед загрузкой вредоносного файла я отключил защиту в windows. Такая атака не сработает в боевых условиях это лишь материал для начального ознакомления!
https://habr.com/ru/articles/1024918/
#c2 #Command_control #пентест #кибербезопасность #обучение #развитие
-
-
-
live #darkcomet #C2 server
196.251.107[.]24:5552confirmed 2026-03-30
