Haetae - An Agent to Takedown N.Korean C2 Servers

The talk introduces Haetae, an agent that profiles North Korean malware command-and-control infrastructure and exploits its weaknesses. The speakers, from a Web3 threat research team, triage three samples. A Go variant of GhostRAT has a second upload endpoint that skips the authentication required on the first. PowerfulArmadillo uses a proof-of-work step whose solved token is accepted indefinitely. MachoMan, a Go-based macOS sample, trusts any request that carries the expected user-agent string.

The exploits were first crafted by hand and then taught to an agent written in Ruby. It has four tools: GET, POST, PUT, and a proof-of-work solver. The proof of work was weak enough to solve on an ordinary phone. The agent works from a strict playbook that maps only known actions, and its prompts are written as if briefing a junior malware reverser. A companion emulator reproduces the minimal vulnerable endpoints, with per-family notes. Live demos showed the agent identifying a strain, solving the challenge, and uploading a file.

The speakers argue that flooding these servers with fake victims and fake data forces operators to spend time sorting noise or to fix their code, and they say the operators have not patched the flaws. The experiment cost under 70 cents in API spend. They also stress that researchers should understand a flaw manually before automating it. The Haetae code and the emulator were to be published on GitHub.