#c2 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #c2, aggregated by home.social.
-
validx[.]shop looked fine at first glance. "Normal" name servers, a real mail setup, nothing that immediately stood out at the apex level. One subdomain didn't quite fit, though. It was getting DNS queries that were absurdly long and frequent for a new domain that nobody was really visiting. Rather than that being web traffic, we detected it as likely tunneling.
Turns out it wasn't a one-off. The same setup shows up on hundreds of other domains.
The domain names follow a similar pattern: short, brandable and portmanteau-y (i.e., cordkit, zenithly, queuebox), spread across a long list of cheap gTLDs with the same registrar.
The tunnel itself is answering with TXT records like:
⚠️ "H2;n=5;k=3;ol=2004;sz=800;cz=gz"
As best as we can tell, that's a shard count, a reconstruction threshold, a length, a chunk size, and a compression flag. We checked the signature against a number of known DNS tunnelling tools and none of them write a header like this.
We watched two more domains get registered mid-investigation, hours apart, which was fun to see and immediately block :ablobcatpopcorn:
We've got the infrastructure and the method. We haven't got a payload, and we haven't matched this header format to anything documented publicly.
Has anyone else run into this, recognize the TXT format above, or have a sample of a possible malware source? We'd like to hear from you.
⛔ validx[.]shop
⛔ cordkit[.]online
⛔ zenithly[.]best☠️ 95[.]179[.]159[.]229
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #c2
-
validx[.]shop looked fine at first glance. "Normal" name servers, a real mail setup, nothing that immediately stood out at the apex level. One subdomain didn't quite fit, though. It was getting DNS queries that were absurdly long and frequent for a new domain that nobody was really visiting. Rather than that being web traffic, we detected it as likely tunneling.
Turns out it wasn't a one-off. The same setup shows up on hundreds of other domains.
The domain names follow a similar pattern: short, brandable and portmanteau-y (i.e., cordkit, zenithly, queuebox), spread across a long list of cheap gTLDs with the same registrar.
The tunnel itself is answering with TXT records like:
⚠️ "H2;n=5;k=3;ol=2004;sz=800;cz=gz"
As best as we can tell, that's a shard count, a reconstruction threshold, a length, a chunk size, and a compression flag. We checked the signature against a number of known DNS tunnelling tools and none of them write a header like this.
We watched two more domains get registered mid-investigation, hours apart, which was fun to see and immediately block :ablobcatpopcorn:
We've got the infrastructure and the method. We haven't got a payload, and we haven't matched this header format to anything documented publicly.
Has anyone else run into this, recognize the TXT format above, or have a sample of a possible malware source? We'd like to hear from you.
⛔ validx[.]shop
⛔ cordkit[.]online
⛔ zenithly[.]best☠️ 95[.]179[.]159[.]229
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #c2
-
I'm currently implementing a feature into my threat intelligence workflow that will send the malware files and payloads I have collected to ‘abuse.ch’, and the download URLs and IP addresses controlled by attackers to ‘URLhause’.
-
📰 Nearly Half of Malware Bypasses DNS Security with Direct-to-IP C2
Unit 42 finds 45% of malware uses direct-to-IP (D2IP) for C2, bypassing DNS security controls. Threats like Phorpiex & SectopRAT use hard-coded IPs to evade detection. #Malware #C2 #ThreatIntel #DNS #Cybersecurity
-
MVG nimmt letzten C2-Zug für Münchner U-Bahn in Betrieb
#Bayern #C2 #Fahrzeugflotte #MVG #München #Nahverkehr #SWM #SiemensMobility #Siemens #UBahn #ÖPNV
https://bahnblogstelle.com/259333/mvg-nimmt-letzten-c2-zug-fuer-muenchner-u-bahn-in-betrieb/ -
MVG nimmt letzten C2-Zug für Münchner U-Bahn in Betrieb
#Bayern #C2 #Fahrzeugflotte #MVG #München #Nahverkehr #SWM #SiemensMobility #Siemens #UBahn #ÖPNV
https://bahnblogstelle.com/259333/mvg-nimmt-letzten-c2-zug-fuer-muenchner-u-bahn-in-betrieb/ -
----------------
🎯 Threat Intelligence
===================Group-IB Threat Intelligence has identified HOLLOWGRAPH, a .NET NativeAOT-compiled DLL malware attributed with high confidence to the Cavern backdoor framework. The malware transforms Microsoft 365 calendars into covert command-and-control channels using the Microsoft Graph API, communicating through a compromised Israeli mailbox.
🔹 Technical Overview
HOLLOWGRAPH operates with only two commands: get and send. Both execute exclusively through trusted Microsoft cloud infrastructure. The malware never reaches out directly to attacker-owned servers. Instead, it uses the Microsoft Graph API to treat a compromised mailbox's calendar as a two-way dead-drop.
🔹 C2 Mechanism
The calendar-based C2 works as follows:
1. Tasking: Operators plant calendar events containing encrypted commands as attachments.
2. Exfiltration: The implant creates its own calendar events with encrypted stolen data attached as files.
3. Concealment: Every event is dated to 13 May 2050, ensuring the mailbox owner is unlikely to notice them.All Graph payloads use hybrid RSA + AES encryption. Two separate key pairs keep tasking and exfiltration channels cryptographically independent.
🔹 Credential Renewal Channel
HOLLOWGRAPH maintains a secondary communication channel through DNS tunneling. It performs IPv6 AAAA record queries against the attacker-controlled domain cloudlanecdn[.]com to refresh its Microsoft Entra ID (Azure AD) credentials. Updated values are written to an on-disk configuration file named logAzure.txt.
This dual-channel architecture provides resilience. Even if the primary Graph API channel is disrupted, the malware can continue receiving refreshed authentication tokens through DNS.
🔹 Victimology
Group-IB identified 12 systems carrying the implant. Only approximately three were actively communicating with attacker infrastructure. The recovered indicators, an Israeli mailbox used for exfiltration and malware samples uploaded from Israel, suggest focused interest in Israeli entities rather than broad opportunistic compromise.
🔹 Detection Considerations
Defenders monitoring Microsoft 365 environments should look for:
• Calendar events with future dates far beyond typical scheduling horizons (e.g., 2050)
• Unusual file attachments on calendar entries
• DNS queries to cloudlanecdn[.]com with AAAA record types
• The on-disk artifact logAzure.txt
• Authentication patterns from .NET NativeAOT binaries interacting with Microsoft Graph API🔹 Attribution
Group-IB links HOLLOWGRAPH to the Cavern backdoor framework with high confidence, based on code and behavioral similarities with known Cavern components.
🔹 HOLLOWGRAPH #ThreatIntelligence #C2 #Microsoft365 #MalwareAnalysis
🔗 Source: https://www.group-ib.com/blog/hollowgraph-microsoft-365/
-
----------------
🎯 Threat Intelligence
===================Group-IB Threat Intelligence has identified HOLLOWGRAPH, a .NET NativeAOT-compiled DLL malware attributed with high confidence to the Cavern backdoor framework. The malware transforms Microsoft 365 calendars into covert command-and-control channels using the Microsoft Graph API, communicating through a compromised Israeli mailbox.
🔹 Technical Overview
HOLLOWGRAPH operates with only two commands: get and send. Both execute exclusively through trusted Microsoft cloud infrastructure. The malware never reaches out directly to attacker-owned servers. Instead, it uses the Microsoft Graph API to treat a compromised mailbox's calendar as a two-way dead-drop.
🔹 C2 Mechanism
The calendar-based C2 works as follows:
1. Tasking: Operators plant calendar events containing encrypted commands as attachments.
2. Exfiltration: The implant creates its own calendar events with encrypted stolen data attached as files.
3. Concealment: Every event is dated to 13 May 2050, ensuring the mailbox owner is unlikely to notice them.All Graph payloads use hybrid RSA + AES encryption. Two separate key pairs keep tasking and exfiltration channels cryptographically independent.
🔹 Credential Renewal Channel
HOLLOWGRAPH maintains a secondary communication channel through DNS tunneling. It performs IPv6 AAAA record queries against the attacker-controlled domain cloudlanecdn[.]com to refresh its Microsoft Entra ID (Azure AD) credentials. Updated values are written to an on-disk configuration file named logAzure.txt.
This dual-channel architecture provides resilience. Even if the primary Graph API channel is disrupted, the malware can continue receiving refreshed authentication tokens through DNS.
🔹 Victimology
Group-IB identified 12 systems carrying the implant. Only approximately three were actively communicating with attacker infrastructure. The recovered indicators, an Israeli mailbox used for exfiltration and malware samples uploaded from Israel, suggest focused interest in Israeli entities rather than broad opportunistic compromise.
🔹 Detection Considerations
Defenders monitoring Microsoft 365 environments should look for:
• Calendar events with future dates far beyond typical scheduling horizons (e.g., 2050)
• Unusual file attachments on calendar entries
• DNS queries to cloudlanecdn[.]com with AAAA record types
• The on-disk artifact logAzure.txt
• Authentication patterns from .NET NativeAOT binaries interacting with Microsoft Graph API🔹 Attribution
Group-IB links HOLLOWGRAPH to the Cavern backdoor framework with high confidence, based on code and behavioral similarities with known Cavern components.
🔹 HOLLOWGRAPH #ThreatIntelligence #C2 #Microsoft365 #MalwareAnalysis
🔗 Source: https://www.group-ib.com/blog/hollowgraph-microsoft-365/
-
#TechnicalTalk
Adversary Village at @defcon 34!
Mauro Eldritch and Nelson Rafael Colón Merán from Bitso will be speaking on “Haetae: An Agent to Takedown North Korean C2 Servers” on 7 Aug 2026 at @defcon Creator Stage 3.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session and speakers:
https://adversaryvillage.org/adversary-events/DEFCON-34/Mauro-Eldritch/
https://adversaryvillage.org/adversary-events/DEFCON-34/Nelson-Rafael/
#AdversaryVillage #DEFCON34
#TechnicalTalk #ThreatActors #NorthKorea #AdversaryIntelligence
#Malware #C2 -
#TechnicalTalk
Adversary Village at @defcon 34!
Mauro Eldritch and Nelson Rafael Colón Merán from Bitso will be speaking on “Haetae: An Agent to Takedown North Korean C2 Servers” on 7 Aug 2026 at @defcon Creator Stage 3.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session and speakers:
https://adversaryvillage.org/adversary-events/DEFCON-34/Mauro-Eldritch/
https://adversaryvillage.org/adversary-events/DEFCON-34/Nelson-Rafael/
#AdversaryVillage #DEFCON34
#TechnicalTalk #ThreatActors #NorthKorea #AdversaryIntelligence
#Malware #C2 -
Several C2 (Command and Control) use case, I didn't realize Counter Strike can also be a C2.
Credit: @hackers_arise
https://hackers-arise.com/living-off-the-land-creative-c2-and-data-exfiltration-options/
-
Several C2 (Command and Control) use case, I didn't realize Counter Strike can also be a C2.
Credit: @hackers_arise
https://hackers-arise.com/living-off-the-land-creative-c2-and-data-exfiltration-options/
-
Как я инфру в буткемпе на Standoff365 проходил [Infra 1] — [Infra 12]
Изначально хотел написать каждый пост для отдельного задания в инфре, но некоторые задания настолько короткие, что писать там даже особо нечего, тем более подсказки в буткемпе очень сильно облегчают решение. Начнем с первой инфры.
https://habr.com/ru/articles/1043364/
#standoff_365 #ctf #infrastructure #windows #activedirectory #kerberoasting #impacket #hash #c2 #adaptix
-
Another Telegram (Mobile) based Command and Control Demonstration (Featuring TeleTunnel v2)
-
Python C2 Server for Red Teaming: A Comprehensive Hands-On Guide
In this guide, I walk through building a Python-based C2 server, covering its architecture, encrypted communication, and real-world operational workflow.
https://denizhalil.com/2025/12/15/python-c2-server-red-teaming-guide/#CyberSecurity #RedTeam #C2 #commandandcontrol #Python #offensivesecurity #Pentesting #infosec #threatdetection #blueteam #securityengineering #ethicalhacking
-
Python C2 Server for Red Teaming: A Comprehensive Hands-On Guide
In this guide, I walk through building a Python-based C2 server, covering its architecture, encrypted communication, and real-world operational workflow.
https://denizhalil.com/2025/12/15/python-c2-server-red-teaming-guide/#CyberSecurity #RedTeam #C2 #commandandcontrol #Python #offensivesecurity #Pentesting #infosec #threatdetection #blueteam #securityengineering #ethicalhacking
-
Una vegada acabada l’experiència prova #C2 de català, aquí van les meves impressions:
Val la pena consultar a l’organisme a través del qual et vas inscriure quin model de prova fan servir. Jo ho vaig demanar on no tocava i vaig acabar estudiant amb un model més fàcil i més curt. -
Una vegada acabada l’experiència prova #C2 de català, aquí van les meves impressions:
Val la pena consultar a l’organisme a través del qual et vas inscriure quin model de prova fan servir. Jo ho vaig demanar on no tocava i vaig acabar estudiant amb un model més fàcil i més curt. -
Как я собрал себе C2 на малинке за один вечер
Давно хотел поднять свой C2-сервер. Ну, чтобы как большие мальчики с доменом, прокси, шифрованным туннелем. Но покупать VPS с 8GB RAM и платить за Cobalt Strike как‑то жирновато. Решил: будет малинка. ВНИМАНИЕ: Эта статья предназначена для ознакомления начинающим исследователям в области Кибербезопасности. Я не предоставляю инструкций по атакам на инфраструктуру. Я не буду тут показывать как обходить защиту windows и какие либо системы обнаружения угроз. Перед загрузкой вредоносного файла я отключил защиту в windows. Такая атака не сработает в боевых условиях это лишь материал для начального ознакомления!
https://habr.com/ru/articles/1024918/
#c2 #Command_control #пентест #кибербезопасность #обучение #развитие
-
-
-
live #darkcomet #C2 server
196.251.107[.]24:5552confirmed 2026-03-30
-
-
-
#C2 domain tree, 2026-03-15 to 2026-03-28
https://abjuri5t.github.io/SarlackLab/*.www[.]childreninachangingclimate[.]org
*.adept[.]uk[.]com
*.dianqi1[.]jiayongdianqi[.]xyz
*.dianqi2[.]jiayongdianqi[.]xyz
*.bj[.]baidubce[.]com -
A ver si alguien me puede explicar una duda que tengo.
Hace dos días recibí mi primera nómina como funcionario de carrera.
Y esto me llama la atención. Para el IRPF, me descuentan el sueldo bruto. Pero para las contingencias comunes y el mecanismo de equidad intergeneracional, ¿por qué me descuentan también las pagas extraordinarias prorrateadas? Porque dichas pagas no las recibo prorrateadas, al año tengo 14 pagas :blobcatthink:
-
Hoy, tras terminar las tareas que tenía pendientes del día anterior (presentación telemática de documentos, escaneo de documentos en papel, etc.), fui a comprobar si ya tenía acceso a la información grabada en el RCE (Registro Central de Extranjeros).
Y, finalmente, ya tengo acceso total a la herramienta de extranjería. Nada me impide realizar cualquier función que me asignen :ablobcatbongotwitter:
-
The most interesting supply chain attack I've ever seen: #trivy
The attack is really bizarre. I learned a lot about GitHub Actions and how the attack was performed.
- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
- https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation
- https://ramimac.me/trivy-teampcp/#timeline
- https://snyk.io/articles/trivy-github-actions-supply-chain-compromise/#cybersecurity #supplychain #github #glassworm #githubactions #attack #TeamPCP #c2
-
Have updated the post on the Sailfish OS C2 phone with some more screenshots and first test photos from a walk by the lake
-
Hoy por fin mi jefe me encomendó trabajo por hacer.
Me dijo que, mientras la policía no me diera de alta para consultar y realizar acciones en el registro central de extranjeros, que podía escanear tasas y actualizar el estado de los expedientes para que sus tasas aparezcan como pagadas.
Y, tras mucho tiempo, hoy me siento orgulloso de mí mismo :ablobcatheartsqueeze: :blob_aww:
