C2 Operators Infecting Themselves

Flare's researchers started with a database of more than 4,000 infostealer logs, all from victims who had visited a cybercrime forum. They used the Verbback C2 tracker, which lists over 11,000 known command-and-control hostnames, and expanded that list by about 8,000 more through DOM content matching. Checking the logs against these hostnames narrowed the pool to five machines that had reached a known C2. The infected devices were spread across Ukraine, Iran, Italy, the Netherlands and Hong Kong, all running Windows 10 or 11 and infected between 2023 and 2024.

Four of the five logs held several hundred credentials for mostly everyday websites. The fifth held only about 30, all tied to malicious activity, and its owner was nicknamed the Maestro. Its browsing history included administrative pages for the Raccoon infostealer back end, and its stored logins covered many panels. Three of the suspicious URLs matched known families: Mystic, Private Loader and a Trojan. The researchers read this as one operator running a layered toolkit, with a loader delivering payloads, a multifunction tool, an infostealer and a Trojan for persistence.

The talk's main lessons are that stealer logs can expose an operator's backstage activity, and that tracing known C2 endpoints may reveal indicators nobody had catalogued yet. That second method was not yet tested at scale. Attempts to identify the operator through their email addresses went nowhere. The speaker suggested that weak operational security, or malware bundled into cracked tools, could explain how the operator was infected.