Large Scale Infiltration and Monitoring of C&C Servers
Where
Talks
ShmooCon 2023
Duration
39 min
Shows how command-and-control servers can be infiltrated and monitored at large scale.
Summary
The talk covers large-scale infiltration of command-and-control (C2) servers, the infrastructure malware uses to receive instructions and move data. It treats these servers as a target that can be reached in volume, rather than as isolated hosts seen from a single infected machine.
The speaker describes monitoring this infrastructure over time, so that the operators' activity and the servers' behaviour can be observed. The focus is on scale, meaning many servers handled together instead of one case at a time.
For practitioners, the main takeaway is that C2 infrastructure can be watched as a source of intelligence. Monitoring it at scale can help with tracking campaigns, understanding how malware operations are run, and spotting new infrastructure earlier, which gives defenders a wider view than single-host analysis alone.
Related talks
Talks·21 min
Estelle Ruellan
Shows how infostealer logs exposed command-and-control operators whose own machines were infected, revealing a malware ecosystem.
Talks·18 min
Estelle Ruellan · Stuart Beck
Traces infostealer logs back to the command-and-control servers and malware families that infected the machines.
Talks·43 min
Joseph Slowik
Explores how state-directed actors use compromised routers and IoT devices as proxy networks to hide command and control.