Command and control (C2) infrastructures are the “brain” behind successful, malicious cyberattacks, including malware, ransomware, ransomware-as-a-service and living-off-the-land attacks. As dangerous cyberweapons, C2 infrastructures are used by cybercriminals to communicate nefarious commands to systems inside a compromised network.

Security operations centres (SOCs) rely on a combination of tools based on their maturity: firewall, endpoint detection and response (EDR), security information and event management (SIEM), network detection and response (NDR), and signature-based detection tools. Threat intel platforms aggregate multiple feeds but do not provide the necessary context for a SOC analyst to take action.

At the same time, threat actors are abusing “red team” tools and legitimate open-source tools by leveraging built-in system applications to gain access to the system. These cybercriminal approaches leave a major gap with no proactive warning capability into C2 infrastructures used by threat actors.

Given that C2 is a malicious behaviour that enables data exfiltration or system control (the later, most-damaging stages of the cyber kill chain), the need to detect these malicious behaviours early is imperative. According to Proofpoint, there is a 20 times increase in attacks using “red team” tools like Cobalt Strike and, according to Sophos, 12% of all attacks leverage a combination of common system applications.

There are even malware-as-a-service platforms (such as the Dark Utilities C2 service) that make it easier for threat actors to set up C2 infrastructures. Dark Utilities is one such hot-ticket platform, attracting nearly 3 000 users since it launched earlier this year. I guess they’ve quit their day jobs. But this type of C2 activity is no joke, and the bad guys are quite skilled at what they do.

Advanced Persistent Threat (APT) actors adopt these “red team” tools and other legitimate open-source tools to scope out the posture of an organisation’s cybersecurity infrastructure. We know these tools provide the framework for legitimate “red team” activities, which is perhaps why they’ve become so appealing as another weapon in the cybercriminal’s arsenal. APTs alter these tools to gain access to systems, establish C2, and launch attacks.

A game changer for threat intelligence

While a defence-in-depth approach to detection and traditional threat intelligence feeds provide visibility of most cybersecurity threats, a glaring gap remains: a lack of threat intelligence that provides early warning of adversary infrastructures so SOC teams can take proactive measures to shift left quickly to defend their network infrastructure. Fortunately, the cybersecurity industry has IronNet’s team of elite threat intel analysts on its side to close this known gap. How? IronRadar.

IronRadar is purpose-built for organisations that want to improve their cybersecurity posture by becoming more proactive and filling a key gap in their detection tools. This unique attack intelligence feed can identify threats as new C2 servers appear and before they are used in sophisticated cyberattacks. In fact, Christopher Kissel, research vice president of security and trust products at International Data Corp calls IronRadar’s feed a “game changer”. It uses an innovative process that “fingerprints” a server and determines whether it is adversary infrastructure while those servers are being stood up, even before a cyberattack is initiated. The data is then enriched with context into purpose-built intelligence updates for proactively blocking adversarial infrastructure.

IronRadar complements the ongoing work of the IronNet Threat Research team, which regularly monitors the Internet for adversary infrastructure

Delivered via a robust API, IronRadar can be consumed by a firewall, a SIEM, a threat intel platform, or any other threat hunting tool. In this way, it empowers SOC teams not only to ingest the data but also to automatically block the attack before it has an impact on the organisation.

Using the data from the feed, SOC analysts can query their SIEM data to find communication to adversary infrastructure, reducing the mean time to threat detection. You could say we’re allowing cyber defenders to proactively detect and block new adversary infrastructure during the critical, incipient stage — before data exfil or system control creates a very bad day for a SOC team, chief information security officer, company and board (not to mention your heretofore trusting customers).

IronRadar complements the ongoing work of the IronNet Threat Research team, which regularly monitors the Internet for adversary infrastructure, including Cobalt Strike. As a result of this monitoring, for example, we tracked Cobalt Strike servers used in Russian cyberattacks on Ukraine.

What are the use cases?

By creating this unique attack intelligence feed, we have considered use cases across the cybersecurity maturity curve. Every organisation is as important to protect as the next. SOC teams can use the feed for:

Basic “block and tackle” purposes
Deeper investigations of potential exposure by looking at data consumed by a SIEM or any other data collection or data lake
Discovery of any past connections to even dormant C2 infrastructure
Real-time observation of attacks for threat recon and investigation

I am proud to say that we have had 98% accuracy over six months, and 97% of our data (IP addresses and domains) has been unique when compared to a leading threat feed, suggesting that, indeed, we are closing a gap in shared threat intelligence.

Don’t just take it from me, though. See for yourself how IronRadar can arm you against weaponised C2 services and level up your cyber defence. Contact [email protected] for a demo or visit ironnet.com for more information.