CYBERTHREATANALYSIS

By Insikt Group®
January 18, 2022

2021 Adversary
Infrastructure Report

CYBER THREAT ANALYSIS

Background
Lead time in identifying malicious servers can be a proactive
measure in neutralizing threats. Before a server can be used
Recorded Future’s Insikt Group® conducted a study of malicious by a threat actor, it has to be acquired, either via compromisecommand and control (C2) infrastructure identified using proactive or legitimate purchase. Then, the software must be installed,scanning and collection methods throughout 2021. All data was sourced
configurations tuned, secure sockets layer (SSL) certificatesfrom the Recorded Future® Platform and is current as of December 10,
registered, and files added to the server. The actors must access
2021.
it via panel login, secure shell (SSH), or remote desktop protocol(RDP), and then expose the malware controller on a port to allow
Executive Summary
the data to transfer from the victim and to administer commands
Recorded Future tracks the creation and modification
to infections. Only then can the server be used maliciously.
of new malicious infrastructure for a multitude of postHowever, in exposing, configuring, and accessing the server,
exploitation toolkits, custom malware, and open-sourcetheadversary leaves behind their fingerprints, which can beremote access trojans (RATs). Since 2017, Insikt Grouphas created detections for 80 families, including RATs, in software versions deployed on the server, the login panel,advanced persistent threat (APT) malware, botnet SSL registration patterns, or the default message returned by afamilies, and other commodity tools. Recorded Future simple probe. These fingerprints create detection opportunities
observed over 10,000 unique command and control (C2) before a phishing email is sent or an implant is compiled.
servers during 2021 across more than 80 families. Our
Similarly, such a collection can illuminate many things aboutcollection in 2021 was dominated by Cobalt Strike Team adversaries. Seeing how many command and control (C2)Servers and botnet families, both of which applied more servers are created can help quantify the breadth of malicious
resiliency and stealth measures throughout the year.
campaigns. Comparing such data to reports of intrusions related

Key Findings• Our prediction last year anticipating an increase
in Sliver, Mythic, Covenant, and Octopus
C2 frameworks was only partially correct.
While there has been small increase in use of
Covenant, Sliver and Mythic, our visibility has
shown continued reliance on Cobalt Strike withminimal adoption of newer C2 frameworks.
• 25% of detected servers (3,400 servers) were
not referenced in open sources; they were only
identified on the Recorded Future Command andControl source.
• Recorded Future observed an average of a
35-day lead time between when a C2 server isdetected by our scanning efforts and when it isreported in other sources.
• While Emotet’s return has garnered headlines,
other botnets have continued to insulate,diversify, and grow their infrastructure during
Emotet’s absence in 2021.

1

to those families can identify how many intrusions get caught
and potentially how many events remain unknown in the publicdomain. Measuring the tempo of server creation can provide
insight into forthcoming surges or drawdowns of activity. Finally,collection can provide novel indicators and intelligence otherwise
unavailable in the public domain.

A Note on Collection Bias
Recorded Future collects information about C2 servers
based predominantly on traits from known malware families
and their server-side software. The nature of this collection
through passive and active internet scan data will be focusedon collecting known command and control frameworks and theirderivatives or support infrastructure. Recorded Future cannot
verify an IP address to be a C2 server without proof of malicious
activity of at least one of the servers in a given family. Therefore,
we will be biased in reporting servers of known threats and havea collection bias towards those servers. These should not act asa replacement for identifying anomalies or detecting odd traffic
inside a network.

CTA-2022-0118

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Threat Analysis

Detections of unaltered Cobalt Strike Team Servers (viathe pre-configured TLS certificate, the presence of a Beacon
The most commonly observed families were mixed between payload, or telltale HTTP headers) represented 23.7% of the total
post-exploitation frameworks and botnet infrastructure. Cobalt C2 servers identified. This detection includes a small subset
Strike Team Servers were again the most detected C2 controller, of C2s using domain-fronting, but most detected Cobalt Strike
representing 23.7% of the total C2 servers identified. Similar to Team Servers are the base model; we do not have an estimate forlast year, Metasploit and Meterpreter represented the other top the number of well-insulated or obfuscated Cobalt Strike TeamC2 servers identified by Recorded Future. TrickBot and QakBot Servers in use. The total number of detected Cobalt Strike Team
Servers includes those with Malleable Profiles.
were also among the 5 most detected families.
BlackBerry researchers observed roughly 6,000 unique
Team Servers in 2021, based both on Beacon payload analysis
and scanning operations. The gap in detections between purescanning operations and a multi-faceted approach highlight how
many Team Servers are evading identification (nearly 3,000)
and how vital diverse collection and analysis functions are for
defense.

Top 5 Most Detected C2 Families
Family2021 C2s

Cobalt Strike Team Servers

3691

Meterpreter

396

Metasploit

710

In 2021, Microsoft, RiskIQ, and Insikt Group all identified
instances of initial access brokers setting up ready-to-use
TrickBot
468
Cobalt Strike Team Servers and infections to their clientele.
This phenomenon was dubbed Cobalt Strike C2-as-a-Service.
Table 1: Top detected C2 infrastructure by total unique servers
This does not include the various Cobalt Strike Team Servers
Post-Exploitation Frameworks
used by various loaders or by ransomware affiliates to kick-start
It is difficult to estimate what percentage of any post- operations from other accesses.
QakBot571

exploitation frameworks we detected are used in legitimate red
The increased detection of Cobalt Strike is partiallyteaming operations, and which are used by criminal or espionage attributable to improved detection methods and analytics, as
elements. Cobalt Strike has a diverse set of users, gaining the evidenced by the public proliferation of more aggressive collection
most direct attention in its use in ransomware operations. There mechanisms. Researchers continue to publish detection logic
was increased adoption of Mythic, Covenant, and high-profile and findings that allow for the decryption of traffic from a large
use of Sliver during 2021; most other post-exploitation tools subset of Cobalt Strike Beacons.
saw similar volumes of deployment compared to 2020. Increased
volume may be tied to improved signatures and increased
collection efforts, but is at least partly a reflection of continued
adoption by various operations.
Top 10 Observed Offensive Security Tools
Family2021 C2s

2020 C2s

Previous Notable Users

Cobalt Strike

3691

1441

APT41, Mustang Panda, Ocean Lotus, FIN7

Meterpreter

731

259

COBALT ILLUSION

Metasploit

710

1122

JointWorm (EVILNUM), TurlaPowershell Empire

269

289

Sandworm, GADOLINIUM

Covenant

180

51

GreenBug, FIN12

PupyRAT

177

454

MuddyWater, TA505

Sliver169

27

WellMess Operators, TA551

Mythic

163

28

N/A

Koadic109

19

SofacyPoshC2103

12

UNC1945

Table 2: Most common offensive security tools by C2 servers detected in 2021

www.recordedfuture.com | Recorded Future ®

CTA-2022-0118

2

CYBER THREAT ANALYSIS

Going Back to Bots

QakBot (QBot)

The briefly successful law enforcement takedown of the
QakBot contains the largest list of C2s per sample, as shown
Emotet botnet left a void in the loader and botnet market. Despite by data from the configuration file included in the malware’s
frequent breaks, the botnet was one of the most prolific and resource section. QakBot’s use of higher TCP ports partially
profitable threats in 2019 and 2020. Although other operations, hindered proactive scanning; roughly 3,200 total IP addresses
such as TR distributor (ChaseLdr, TA577) or TA551 (Shathak), were observed through configuration extraction, where 516
attempted to fill the spam gap left by Emotet’s months-long servers were observed via proactive scanning. Infrastructure
disappearance, TrickBot, QakBot, Bazar, IcedID, and Dridex throughout 2021 has also been divided across affiliates; forall continued onward. All of them have been observed acting example, QakBot samples deployed by the TR distributor
as precursors to ransomware; IcedID was linked to Egregor (ChaseLdr, TA577) and the Obama affiliate shared 95% of the
deployments, TrickBot and Bazar families have been linked to same infrastructure, distinct from the 95% infrastructure overlap
Ryuk and Conti use, Dridex has led to DoppelPaymer, and QakBot between the Biden and Clinton affiliates. The Abc affiliate
has deployed ProLock and DoppelPaymer.
operated on a relative island, with only 8% overlap with the Biden
and Clinton infrastructure. Previously, TR and Biden affiliates had
Sample over sample, the botnets varied in how manya large overlap in infrastructure; this cycling is likely to improveembedded C2 servers they referenced. TrickBot averaged 20
resiliency across the operation.
C2 servers per sample configuration, while IcedID and Dridex
each averaged 3 servers, and QakBot averaged a much larger
TrickBot
142 C2 IP addresses per configuration. Resurfaced versions of
Emotet averaged 20 servers per configuration.
TrickBot’s large volume of infrastructure for 2021 is partiallyaccounted for by the botnet splitting its infrastructure into 2
Top 5 Most Prolific Botnet Families
distinct branches. Each branch was built by distinct server
types in early 2021, before using identical but distinct C2
Family2021 C2s
nodes beginning in March 2021. Recorded Future’s visibility
TrickBot
571
indicates the “original branch” serviced TrickBot clients while
QakBot516
the “secondary branch” was used by TrickBot operators or highly
trusted affiliates. The shift is likely a resiliency effort: TrickBot
Bazar/Baza Family
405
operators can continue spamming operations via a secondary
Dridex383
botnet branch, even if the more used one gets taken down or
IcedID
332
blocked based on the volume of infections.
Table 3: Most common botnet families by C2 servers detected in 2021

Bazar Family

The botnets vary greatly in terms of active operational size;
Both BazarLoader (YerLoader, BazaLoader, and KEGTAP) andsampling concurrently active servers from Recorded Future data
BazarBackdoor(Syndet, BEERBOT) often share infrastructure
showed TrickBot maintained 132 C2 servers at a given time,or
deploysimilarserver configurations, leading us to list themBazar peaked at 99, while IcedID had 83, QakBot had 72, andtogether.
Althoughthe family can and originally did use Emercoin
Dridex had 32 active C2 servers. This measure does not accountfor how the operators divide the infrastructure but is based on DNS (EmerDNS) .bazar as primary/backup domains for command
observable operational size indexed within the Recorded Future and control, operators have often relied on more straightforward
IPv4 addresses during 2021. The Bazar families, more so than
Platform.
others listed here, continually evolved their server software,
deploying multiple server configurations simultaneously during2021, likely in attempts to evade detection.

3

CTA-2022-0118

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Global Scale

DridexIn comparison, Dridex has a much smaller list of hardcoded
We observed the creation of C2 infrastructure on 1,650
C2s in its respective configurations. Each Dridex affiliate uses a hosting providers across 130 different countries. While thisdifferent configuration file embedded in Dridex’s main payload. represents a majority of global geography, the abused servers
The affiliate IDs are regularly rotated or aged off, making it account for only a small percentage of the total AS operators,
difficult to track customers or methods used for distribution over which exceeds 60,000 providers. The data indicates the largest
time. Dridex has regularly updated its payload to make it more hosting providers are the most abused for C2 hosting; 20 AS
stealthy, but there are no indications that it did the same with its operators (12% of total ASNs observed) had more than 100 C2
infrastructure in the wake of Emotet’s takedown.
servers detected on them during 2021.

IcedID (BokBot)
Unlike other botnets, IcedID does not openly track its clientsor users, although we believe its developers operate under anaffiliate model. IcedID infrastructure is also less mature in its
operational security, continuing to use the same pool of servers
for its operations despite the publication of methods to ID theservers. Although IcedID effectively generates infections, it does
not display the same level of operational security as the otherfamilies mentioned.

EmotetEmotet’s return has rightly caused concern among security
researchers. Within 24 hours of new Emotet samples being
loaded by TrickBot, the botnet began spamming. Within a week,
a second branch was established to service more global spam
operations. There have been 40 positively identified Emotet
C2s derived from the samples across both epochs, with anadditional 45 servers that share server patterns that will likely
be used as Tier 1 servers by Emotet. There have been at least
4 servers observed hosting both Dridex and Emotet Tier 1
controller software. While the total count is not greater thanother botnets mentioned here, the infrastructure creation rate
indicates the operators have ambitions to return Emotet to its
former prominence and power.

www.recordedfuture.com | Recorded Future ®

• The US hosted 4,654 C2 servers in 2021; China wassecond with 1,949, and Germany was third with 629.
• 858 AS operators (52% of total ASNs observed) wereobserved hosting 1 C2 server during 2021.
• 24 countries of the 130 observed hosting C2 servers
hosted only C2 1 server during 2021.
• While Recorded Future observed 1,630 unique AS
operators hosting C2 servers during 2021, the heavy
majority were observed hosting 100 or fewer C2s.
• 1,454 AS providers (88% of total ASNs observed) hosted
fewer than 10 C2 servers.

CTA-2022-0118

4

CYBER THREAT ANALYSIS

Figure 1: Most common countries based on total C2 servers detected in 2021 (Source: Recorded Future)

Top 10 C2 Hosting Providers By Volume
Hosting Provider

ASN

Country

Top Family

Total C2’s

Digital Ocean

AS14061

United States

Cobalt Strike

968

Choopa, LLC

AS20473

United States

Cobalt Strike

700

Amazon.com, Inc.

AS16509

United States

Cobalt Strike

624

Hangzhou Alibaba AdvertisingAS37963

China

Cobalt Strike

574

Shenzhen Tencent Computer Systems

AS45090

China

Cobalt Strike571

OVH SAS

AS16276

FranceCobalt Strike

267

Linode LLC

AS63949

United States

Cobalt Strike

208

Microsoft Corporation

AS8075

United States

Cobalt Strike

205

BGPNET Global

AS64050

Singapore

Metasploit

181

M247 Ltd

AS9009

United Kingdom

Cobalt Strike & PupyRAT

171

Table 4: Hosting providers who hosted the most C2 servers during 2021

5

CTA-2022-0118

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Digital Ocean, operating out of the United States, hosted
the most C2s of any of the ASNs observed by Recorded Future.
They accounted for 968 individual C2 servers (7.1%). The mostcommonly observed family on Digital Ocean was Cobalt Strike,with 167 servers identified. The next largest was Choopa LLC(recently renamed the Constant Company), a Virtual Private
Server provider operating out of the US, while the owner of themost C2s observed in 2020 (Amazon.com Inc.) dropped to thirdin 2021.
While these hosting providers accounted for the largest
number of C2 servers, the C2 servers represented a minuscule
percentage of total number of servers under their jurisdiction.
The table below highlights the 10 providers with the highest
percentage of C2 servers compared to their total holdings. Thisestimate is based on the number of IPv4 prefixes announced by
the AS, compared to confirmed C2 servers observed in 2021.
Some of these providers, such as Media Land LLC, canbe categorized as bulletproof hosting providers and are being
marketed on underground forums. These providers also hadmuch more diverse malware hosting than the largest volumes
seen above, including AXIOMATICASYMPTOTE, a server-side
component typically used to administer ShadowPad infections.
Hosting Providers with Highest Percentage of C2s Hosted
Hosting Provider

ASN

Country

Top Detection

Percent ofHosts are C2Media Land LLC

AS206728

RussiaCobalt Strike

5.96%

Lider Telecomunicaçoes Eireli

AS268773

Brazil

njRAT

5.07%

Danilenko, Artyom

AS208476

Germany

AsyncRAT

2.60%

International Hosting Solutions LLP

AS213354

United Kingdom

BazarLoader

2.53%

NXTSERVERS SRL

AS64398

Romania

IcedID

1.41%

HOSTKEY

AS395839

United States

Cobalt Strike

1.07%

Beijing 3389 Network Technology

AS136146

China

Fakenocam

0.90%

RM Engineering LLC

AS49877

RussiaCobalt Strike

0.72%

HDTIDC LIMITEDAS136038

Hong Kong

AXIOMATICASYMPTOTE

0.56%

Host Sailor Ltd.

AS60117

United Arab Emirates

Cobalt Strike

0.46%

Table 5: Hosting providers who hosted the highest percentage of C2 servers compared to total
servers during 2021

www.recordedfuture.com | Recorded Future ®

CTA-2022-0118

6

CYBER THREAT ANALYSIS

Outlook

Mitigations and Recommendations

We anticipate that 2022 will include further insulation and
To help safeguard systems, we advise the following
modification of C2 servers to avoid detection. In response to
mitigations:2020 takedown attempts, TrickBot’s operators hardened their• Use the Recorded Future Platform to help identify
infrastructure to include more global VPS servers, in contrast
actively exploited vulnerabilities and CVEs thatto their previous reliance on compromised MikroTik routers. We
have been positively associated with ransomware
anticipate the lessons learned from action against TrickBot andvariants, which can help with patch management andEmotet will lead to increased reliance on compromised devices,prioritization.
regular recycling of infrastructure, and the use of more resilient
traffic encryption methods.
We also believe that similar methods will be employed by
Cobalt Strike users, to protect Team Servers from the prying eyesof researchers. This will likely result in the dropping of traffic fromknown scanning engines and the use of redirects to mask thelocation of the Team Server (or other C2 nodes). This trend has
likely already begun; BlackBerry’s findings based on extracting
configurations and internet scanning, identified roughly twice as
many Team Servers as scanning alone. As internet scanning has
become table stakes for intelligence providers, adversaries andred team operators have taken notice. We believe this is due toimproved insulation of the Team Servers.
Finally, we expect the C2 environment to continue to diversify.
As new malware families and C2 frameworks are released, we
anticipate a portion of them will be aware of threat intelligencemeasures to scan and detect their servers. This will likely
lead to partially decreased efficacy for threat intelligencescanning efforts in the short term but will result in new creative
methodologies in the medium to long term. The detection catand-mouse game will continue, with both sides continuing toinnovate to thwart the other.

• Keep systems and software up to date and have areliable and tested backup method.
• Exposed RDP servers are abused by threat actors togain initial access into a target’s network. If remote
access solutions are crucial to daily operations, allremote access services (such as Citrix or RDP) should be
implemented with multi-factor authentication.
• Password-protect sensitive files using strong, complex
passwords.
• Detection in Depth• Proactive detection creates an advantage for defenders,giving them preparatory time to ensure additional fileand network-based detections are in place.
• Employ detection-in-depth for common open-source
tooling via correlation searches and Sigma queries in
SIEMs for suspicious behaviors, YARA for suspicious filecontents, and Snort for suspicious or malicious network
traffic.
• The detections for each family show the increased use ofopen-source tools beyond just the families that get major
publicity. Prioritize these families for network and hostbased detection in enterprise environments.
• External network detections are only part of thedetection equation; detection-in-depth methodologies,
such as calculating the standard deviation of beaconing
intervals or using YARA for memory inspection, can aid in
the identification of malicious activity.

7

CTA-2022-0118

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

About Insikt Group®
Recorded Future’s Insikt Group, the company’s threat research division, comprises
analysts and security researchers with deep government, law enforcement, military, andintelligence agency experience. Their mission is to produce intelligence that reduces
risk for clients, enables tangible outcomes, and prevents business disruption.

About Recorded Future®
Recorded Future is the world’s largest provider of intelligence for enterprisesecurity. By combining persistent and pervasive automated data collection and analytics
with human analysis, Recorded Future delivers intelligence that is timely, accurate,
and actionable. In a world of ever-increasing chaos and uncertainty, Recorded Futureempowers organizations with the visibility they need to identify and detect threats
faster; take proactive action to disrupt adversaries; and protect their people, systems,
and assets, so business can be conducted with confidence. Recorded Future is trusted
by more than 1,000 businesses and government organizations around the world.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0118

8