Command and control (C2) infrastructures are the “brain” behind successful, malicious cyber attacks, including malware, ransomware, ransomware-as-a-service, living-off-the-land attacks, etc. As dangerous cyber weapons, C2 infrastructures are used by cyber criminals to communicate nefarious commands to systems inside a compromised network.
SOCs rely on a combination of tools based on their maturity: firewall, endpoint detection and response (EDR), Security Information & Management (SIEM), network detection and response (NDR), and signature-based detection tools. Threat intel platforms aggregate multiple feeds but do not provide the necessary context for a SOC analyst to take action.
At the same time, threat actors are abusing red team tools and legitimate open source tools by leveraging built-in system applications to gain access to the system. These cyber-criminal approaches leave a major gap with no proactive warning capability into C2 infrastructures used by threat actors.
Given that C2 is a malicious behavior that enables data exfiltration or system control (the later, most-damaging stages of the cyber kill chain), the need to detect these malicious behaviors early is imperative. According to Proofpoint, there is a 20x increase in attacks using red team tools like Cobalt Strike and, per Sophos, 12% of all attacks leverage a combination of common system applications.
There are even malware-as-a-service platforms (such as the Dark Utilities C2 service) that make it easier for threat actors to set up C2 infrastructures. Dark Utilities is one such hot-ticket platform, attracting nearly 3,000 users since it launched earlier this year. We guess they’ve quit their day jobs. But this type of C2 activity is no joke, and the bad guys are quite skilled at what they do.
Advanced Persistent Threat (APT) actors adopt these red team tools and frameworks (such as Cobalt Strike) and other legitimate open-source tools to scope out the posture of an organization's cybersecurity infrastructure. We know these tools provide the framework for legitimate red team activities, which is perhaps why they’ve become so appealing as another weapon in the cyber criminal’s arsenal. APTs alter these tools to gain access to systems, establish C2, and launch attacks.
A game-changer for threat intelligence
While a defense-in-depth approach to detection and traditional threat intelligence feeds provide visibility of most cybersecurity threats, a glaring gap remains: a lack of threat intelligence that provides early warning of adversary infrastructures so SOC teams can take proactive measures to shift left quickly to defend their network infrastructure. Fortunately, the cybersecurity industry has IronNet’s team of elite threat intel analysts on its side to close this known gap. How? IronRadar.
What is IronRadar?
Purpose-built for organizations that want to improve their cybersecurity posture by becoming more proactive and filling a key gap in their detection tools. This unique attack intelligence feed can identify threats as new C2 servers appear and before they are used in sophisticated cyber attacks. In fact, Christopher Kissel, Research Vice President of Security and Trust Products, IDC, calls our feed a “game changer.” It uses an innovative process that fingerprints a server and determines whether it is adversary infrastructure while those servers are being stood up, even before a cyber attack is initiated. We then enrich the data with context into purpose-built intelligence updates for proactively blocking adversarial infrastructure.
Delivered via a robust API, IronRadar can be consumed by a firewall, a SIEM, a threat intel platform, or any other threat hunting tools. In this way, it empowers SOC teams not only to ingest the data but also to automatically block the attack before it has an impact on the organization.
Using the data from the feed, SOC analysts can query their SIEM data to find communication to adversary infrastructure, reducing the mean time to threat detection. You could say we’re allowing cyber defenders to proactively detect and block new adversary infrastructure during the critical, incipient stage — before data exfil or system control creates a very bad day for a SOC team, CISO, company, and board (not to mention your heretofore trusting customers).
IronRadar complements the ongoing work of the IronNet Threat Research team, which regularly monitors the internet for adversary infrastructure, including Cobalt Strike. As a result of this monitoring, for example, we tracked Cobalt Strike servers used in Russian cyberattacks on Ukraine.
What are the use cases?
By creating this unique attack intelligence feed, we have considered use cases across the cybersecurity maturity curve. Every organization is as important to protect as the next. SOC teams can use the feed for:
- Basic “block and tackle” purposes
- Deeper investigations of potential exposure by looking at data consumed by a SIEM or any other data collection or data lake
- Discovery of any past connections to even dormant C2 infrastructure
- Real-time observation of attacks for threat recon and investigation
We are proud to say that we have had 98% accuracy over six months, and 97% of our data (IP addresses and domains) has been unique when compared with a leading threat feed, suggesting that, indeed, we are closing a gap in shared threat intelligence.
