C2 Infrastructure Flashcards
What’s the primary purpose of a CDN in C2 infrastructure?
Blends malicious traffic with legitimate content distribution
Provides geographic distribution of payloads
OPSEC: Appears as normal web traffic (e.g., Azure CDN, CloudFront)
Name 3 types of redirectors and their functions
HTTP(S): Proxy traffic (Nginx/Caddy) with TLS termination
DNS: Resolve domains to backend IPs
SMTP: Email-based C2 filtering
OPSEC: Prevents direct Team Server exposure
How does domain fronting evade detection?
Uses legitimate domains in TLS SNI field (e.g., google.com)
Routes traffic to malicious backend via shared CDN
OPSEC: Makes traffic appear to go to trusted services
What hardening is critical for C2 Team Servers?
Network isolation (private VPC/VNet)
Encrypted disks (LUKS/Azure CMK)
Port obscurity (non-50050 for Cobalt Strike)
OPSEC: Never exposed to direct internet access
Name 3 stealthy payload delivery methods
Signed MSI packages via stolen certs
OneNote files with embedded LNKs
Cloud Storage (S3/GCS) with pre-signed URLs
OPSEC: Bypasses “untrusted source” warnings
What distinguishes a beacon from other implants?
Checks in at randomized intervals (jitter)
Uses protocol mimicry (HTTP/HTTPS/DNS)
OPSEC: Small memory footprint, no disk writes
How do dead drops enhance persistence?
Implants fetch new C2 IPs from benign sites (GitHub Gist, Pastebin)
Uses steganography in images/TXT records
OPSEC: Avoids hardcoded C2 endpoints
Why use canary tokens in redirectors?
Triggers alerts if scanned (e.g., fake /wp-admin paths)
Detects security researcher activity
OPSEC: Early warning of infrastructure discovery
What makes WireGuard preferable for C2?
Lightweight (~4K LOC vs OpenVPN’s 600K)
Native roaming between IPs
OPSEC: Easier to blend with legit VPN traffic
Key logging practices for C2 OPSEC
Centralized logging (Graylog/Elastic)
Short retention periods (<72hrs)
Log sanitization (remove client IPs)
OPSEC: Limits forensic evidence
Why use Let’s Encrypt vs self-signed certs?
Trusted by default in all browsers
Automatic 90-day rotation
OPSEC: Avoids “invalid cert” warnings
How to implement geographic filtering
Block non-target regions at CDN/WAF layer
Use ASN blocks for cloud providers
OPSEC: Reduces scanning/analysis from foreign IPs
What do malleable C2 profiles control?
HTTP headers/paths matching target industry
TLS fingerprint customization
Sleep/jitter patterns
OPSEC: Makes traffic pattern unique per engagement
