Loading story…
Security researchers described how defenders can use passive OSINT sources to identify and cluster malicious internet infrastructure, particularly HTTP(S)-based command-and-control servers, by analyzing artifacts left behind in headers, response bodies, passive DNS records, and TLS certificates. The reporting highlights that attacker operational mistakes, infrastructure automation, and efforts to mimic legitimate services often create repeatable fingerprints that can be searched at scale across internet-exposed hosts.
Censys demonstrated the approach with examples including Cobalt Strike servers that expose a characteristic HTTP 404 response pattern and infrastructure linked to APT29 malware such as WellMess and WellMail, which could be tracked through distinctive self-signed certificate distinguished names. The guidance recommends combining host telemetry with certificate and DNS data, preserving historical results, and documenting queries so security teams can build durable visibility into adversary infrastructure and uncover related systems over time.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Censys published a defensive threat-intelligence article describing passive OSINT methods for identifying and clustering malicious HTTP(S)-based infrastructure. It highlighted artifacts in HTTP headers, response bodies, and TLS certificates, using Cobalt Strike and APT29 WellMess infrastructure as examples.
A July 2020 NCSC UK advisory said APT29 targeted organizations connected to COVID-19 vaccine development. The advisory said the group used Citrix and VPN vulnerabilities and deployed the WellMess and WellMail malware families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers detailed a lightweight method for identifying **IcedID** command-and-control infrastructure without relying on full malware reverse engineering, using a distinctive self-signed TLS certificate repeatedly found on the malware’s servers. The certificate commonly carries issuer and subject values including `CN=localhost`, `C=AU`, `ST=Some-State`, and `O=Internet Widgits Pty Ltd`, allowing defenders to search internet-wide scan data for likely matches and rapidly narrow candidate hosts tied to the banking trojan. The infrastructure was then validated by reproducing IcedID’s certificate verification logic, in which the malware hashes the certificate public key with **FNV-1a 32-bit** and compares the result to the certificate serial number, sometimes after XOR with `0x384A2414`. Using that process, researchers confirmed **52** IcedID servers and found the infrastructure commonly exposed ports **443**, **80**, and **22**, frequently ran **Debian** and **nginx**, and was concentrated in **Romania, the United States, and Germany**; related reporting on IcedID and its loader activity underscores the malware’s continued use in credential theft and banking-focused intrusions.
Aug 15, 2026
Security researchers detailed multiple ways to identify and decrypt **Cobalt Strike** command-and-control traffic, including the use of known private RSA keys recovered from cracked or rogue distributions. NVISO reported finding six unique RSA key pairs inside leaked Cobalt Strike ZIP packages and said more than 25% of over 1,500 fingerprinted Internet-facing servers used one of two widely reused key pairs, allowing analysts to identify rogue beacons and in some cases decrypt beacon metadata and full C2 communications with tools such as **1768.py**. The research also showed how defenders can recover and decode traffic protected by **malleable C2** transformations and sleep-masked beacon memory. Analysts can reverse custom transforms such as dropped bytes, Base64 URL decoding, and XOR decoding to recover encrypted payloads, then extract AES and HMAC keys from process memory—even when beacon memory is obfuscated during sleep—using tools including **cs-analyze-processdump.py**, **cs-extract-key.py**, and **cs-parse-traffic.py** to decrypt HTTP(S) and DNS beacon traffic.
Aug 15, 2026
Researchers traced command-and-control infrastructure used in a malicious email campaign targeting Ukraine to multiple **Cobalt Strike** servers and customized **Malleable C2** profiles designed to evade detection. The activity, described in **CERT-UA alert `#4490`**, involved malicious Microsoft Office macros attempting to deploy Cobalt Strike Beacon, while follow-on analysis identified at least eight distinct malleable profiles across the related infrastructure. Two 2022 profiles stood out: a common jQuery-themed profile and a rarer **"minimal defender bypass"** profile using the URI `/apiv8/getStatus`, with the latter sharing watermark `1580103824` across several domains and suggesting a clustered operator footprint. The reporting shows how Cobalt Strike’s profile customization can make beacon traffic resemble legitimate web activity and frustrate signature-based detection, especially when operators alter HTTP, HTTPS, or DNS transaction patterns instead of relying on default Beacon behavior. Investigators also found operational consistency in the campaign’s infrastructure, including concentration at a small set of hosting providers and registrars such as **HostKey** and **Eranet**, and identified an additional related domain, `furfen[.]com`, beyond those listed in the original alert. Together, the findings indicate a coordinated effort to tailor C2 traffic and reuse infrastructure in attacks against Ukrainian targets.
Aug 15, 2026