CYBERTHREATANALYSIS

By Insikt Group®
CTA-2021-0107

ADVERSARY INFRASTRUCTURE REPORT 2020:

A DEFENDER’S VIEWCYBER THREAT ANALYSIS

Background
Lead time in identifying malicious servers can be a proactive
measure in neutralizing threats. Before a server can be used by a threatactor, it has to be acquired, either via compromise or legitimate purchase.
Then, the software must be installed, configurations must be tuned, andfiles added to the server. The actors must access it via panel login, SSH,or RDP protocols, and then expose the malware controller on a port toallow the data to transfer from the victim and to administer commands
to infections. Only then can the server be used for malicious purposes.
However, in exposing, configuring, and accessing the server,
the adversary leaves behind their fingerprints; sometimes in software
deployed on the server, sometimes via the login panel, sometimes via
SSL registration patterns. This creates an opportunity for detection,
which can occur prior to a phishing email being sent or an implant gettingcompiled.
Similarly, such a collection can illuminate many things about
Recorded Future’s Insikt Group® conducted a study of malicious command andcontrol (C2) infrastructure identified using proactive scanning methods throughout
2020. All data was sourced from the Recorded Future® Platform. Data in this report
is as of November 15, 2020.

adversaries. Seeing how many command and control (C2) servers are
created can help one quantify the breadth of an actor’s campaigns.
Comparing such data to reports of intrusions related to those families
can identify how many intrusions get caught, and potentially how many
events remain unknown in the public domain. Finally, it can provide novel

Executive Summary

indicators and intelligence that is otherwise not available in the public

Recorded Future tracks the creation and modification of new
malicious infrastructure for a multitude of post-exploitation toolkits,
custom malware frameworks, and open-source remote access trojans.
The effort has been ongoing since 2017, when Insikt Group createdmethodologies to identify the deployments of open-source remote
access trojans (RATs). Recorded Future collected over 10,000 uniquedomain.

Threat Analysis
The most commonly observed families were dominated by opensource or commercially available tooling. Detections of unaltered Cobalt
Strike deployments (the pre-configured TLS certificate, Team Servercommand and control servers during 2020, across more than 80 families.

administration port, or telltale HTTP headers) represented 13.5 percent

Key Findingsof the total C2 servers identified. Metasploit, and PupyRAT represented•

the other top open-source command and control servers identified by

Over 55 percent of detected servers (5,740 servers) were notreferenced at all in open sources; they were only identified inRecorded Future.
Top 5 Most Prolific C2 Families

a proprietary Recorded Future list of command and controlservers.
•On average, command and control servers had a lifespan(that is, the amount of time the server hosted the maliciousinfrastructure) of 54.8 days.

•Where possible, lead time was calculated if the detection was
the first event for an IP address in 2020. Lead time is the lengthof time (in days) between when a C2 server is created, andwhen it is reported or detected in other sources. This identified
924 servers where lead time was generated, by comparing firstFamily

2020 C2s

Cobalt Strike

1441

Metasploit

1122

PupyRAT

454

Table 1: Top detected malware families by command and control infrastructure (Thesenumbers include preexisting servers that were still up at the time of analysis and do not
represent newly created servers in 2020).

sighting on the Recorded Future command and control list and••its subsequent sighting on another source. Our detections had

The top 10 most common offensive security tools (OST), based

an average 61-day lead time before an IP address was foundon the number of observed C2 servers, included new and old families.

on open sources.

Notably, Recorded Future observed 393 Cobalt Strike servers that wereMonitoring only “suspicious” hosting providers can leaveoutside of common detection mechanisms; we assess these detections

blindspots, as 33 percent of C2s observed by Recorded Future

only represent a portion of total Cobalt Strike use. PWC and Blackberry

were hosted in the United States, many on reputable providers.

found that a majority of Cobalt Strike deployments for which a payload

The hosting providers that had the most command and control

was observed used cracked or trial versions of the commerciallyservers on their infrastructure were all U.S.-based: Amazon,

available tool.

Digital Ocean, and Choopa.
•

Detecting offensive security tools is just as important as
detecting custom implants: elite operators from APT groups,
human-operated ransomware actors, and common criminals
use these tools to cut costs just as much as red teams do. Over40 percent of the detections were open source tools.

1CTA-2021-0107

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Top 10 C2 Hosting Providers

Top 10 Observed Offensive Security Tools

Cobalt Strike

Total
C2s

Notable Users

Hosting Provider

ASN

Country

Top Family

APT41, Mustang Panda, Ocean

Amazon.com, Inc.

AS16509

United States

Cobalt Strike

471

Digital Ocean

AS14061

United States

Metasploit

421

FamilyLotus, FIN7

Metasploit

JointWorm (EVILNUM), Turla

Choopa, LLC

AS20473

United States

Cobalt Strike

368

PupyRAT

APT33, COBALT ILLUSION

Zenlayer Inc

AS21859

United States

Roaming Mantis

358

Powershell Empire

Sandworm, GADOLINIUMHangzhou Alibaba

AS37963

China

Cobalt Strike

335

Meterpreter

MuddyWater, TA505

ICIDC Network

AS136800

China

Cobalt Strike

277

Covenant

APT34 (GreenBug)

OVH SAS

AS16276

FrancePupyRAT

273

Armitage

WIZARD SPIDER (UNC1878)1

AS45090

China

Cobalt Strike262

Octopus C2

Unnamed Chinese APT

AS15169

United States

Bozok RAT241

SliverN/A

Responder

APT28, APT40 (TEMP.Periscope)

AS6870Russia

DarkComet

205

PoshC2

UNC1945

Advertising

Shenzhen Tencent
Computer Systems
Google LLC
Space-IX RECONN LLC

Table 4: Hosting providers who hosted the most command and control servers during 2020.

Table 2: Example open source malware families tracked by Recorded Future (These numbers
include preexisting servers that were still up at the time of analysis and do not represent newly
created servers in 2020).

There is less predictability in the most common ASNs used across OSTs,
as they are readily available for red team exercises and unauthorized intrusions.

Nearly all of the OSTs detected by Recorded Future have been linked toAPT or high-end financial actors. The ease of access and use of these tools,

Top OST Hosting Providers

mixed with the murkiness of potential attribution makes them appealing forunauthorized intrusions and red teams alike. This, in addition to the adoption ofthese frameworks by ransomware actors, makes their detection a priority.

Host(er)s With the Most (C2s)
Recorded Future C2 data allowed us to identify the most popular hosting
providers for C2 servers. We observed the creation of C2 infrastructure on 576
hosting providers, representing only a small percentage of the total AS operators,
which exceeds 60,000 providers.
The most-used ASNs are undoubtedly linked to the size of the provider, notnecessarily implying that they are bulletproof hosting providers or complicit inadversary actions. The most used tooling can be considered dual use, increasing
the volume of these servers on more reputable AS ranges.
Amazon.com, Inc., operating out of the United States, hosted the most C2s ofan ASN observed by Recorded Future. They accounted for 471 individual commandand control servers (roughly 3.8 percent). The most commonly observed family onAmazon.com, Inc. was Cobalt Strike, with 167 servers identified. The next largest

FamilyHostingProvider

ASN

Country

C2s

Cobalt Strike

ICIDC NETWORKAS136800

China

259

AS45090

China

124

Digital Ocean

AS14061

United States85

Digital Ocean

AS14061

United States

43

AS16509

United States

29

Metasploit
PupyRATPowershellEmpire
Covenant

ShenzhenTencent Limited

Amazon.com,
Inc.

Table 5: Top hosting providers for each OST.

Publicly available tooling published as remote access trojans (RATs) also had
limited predictability of its favored hosting providers.

was Digital Ocean, also operating out of the U.S.
Servers in the United States that accounted for other top hosting providers
can be seen below. The deployment of Cobalt Strike and Metasploit controllers

RATs’ Favorite Hosting Providers

on these providers is not indicative of malpractice or negligent hosting, but isFamily

Hosting Provider

ASN

CountryC2smore likely due to authorized red teams using these tools on cloud infrastructure.

QuasarRAT

Internap Corporation

AS19024

United States

175

DarkComet

RECONN LLC

AS6870Russia89

Bozok RAT

Google LLC

AS15169

United States

62

njRAT

Crnogorski Telekom

AS8585Montenegro

32

AS1659Taiwan14

REMCOS
1On October 29, 2020, Recorded Future detected an Armitage certificate on the IP 179.43.128[.]5, which was also
hosting a Cobalt Strike server used by UNC1878, with likely intent to deploy Ryuk Ransomware.

www.recordedfuture.com | Recorded Future ®

Taiwan Academic
NetworkTable 6: Top hosting providers for each RAT.

CTA-2021-0107

2

CYBER THREAT ANALYSIS

Recommendations••••

Outlook

Proactive detection creates an advantage for defenders, giving themOver the next year, Recorded Future expects further adoption of open source

preparatory time to ensure additional file- and network-based detections

tools that have recently gained popularity, specifically Covenant, Octopus C2,are in place.

Sliver, and Mythic. Three of these tools had graphical user interfaces, making

Recorded Future clients can rapidly identify infections by detecting IP

them easier to use for less experienced operators, and all four have verbose

addresses found in the Recorded Future Command and Control List.

documentation on their uses. These tools had rapid adoption after their releases

Recorded Future users can query any malware entity, using the source

and were used by both red teams and unauthorized actors. Despite expected gains

Recorded Future Command and Control List, to conduct similar researchby these open source frameworks, Cobalt Strike will very likely maintain its leadof their own.

atop our detections, due to its ubiquity and utility. Since the source code of the

Employ detection-in-depth for common open source tooling via

framework has leaked, we anticipate even further adoption of Cobalt Strike by all

correlation searches for SIEMs for suspicious behaviors, YARA for

facets of threat actors.

suspicious file contents, and SNORT for suspicious or malicious network••We also anticipate that, despite various publications detailing detection

traffic.

methodologies, espionage-oriented actors are less likely to modify their server-The detections for each family show the increased use of open sourceside components. Threat actors engaged in state-sponsored espionage will use

tools beyond just the families that get major publicity. These otherwhatever tooling necessary to achieve their goals. If targeted organizations arefamilies should be prioritized for network and host-based detection in

unable to defend their network from tooling that has been disclosed, threat actors

enterprise environments.

have little motivation to pursue new capabilities. Financially motivated actors

The adoption of lesser-known open source tooling such as OctopusC2,using custom tooling, however, are very likely to respond to detections by either

Mythic, and Covenant by APT and criminal adversaries highlights therebuilding their components (as was the case with BazarBackdoor and TrickBot

need for threat intelligence practitioners to track and evaluate use ofactors) or introduce entirely new tooling (which FIN7 is known to do).

these tools.

Due to these factors, it is important to implement security controls andmitigations against these malware families. While proactive detection of thecommand and control servers can help prevent incidents, defense-in-depth
approaches are recommended to detect intrusion activity on the victim host, atthe perimeter, and on the wire.

www.recordedfuture.com | Recorded Future ®

CTA-2021-0107

3

CYBER THREAT ANALYSIS

About Recorded Future
Recorded Future arms security teams with the only complete security intelligencesolution powered by patented machine learning to lower risk. Our technology
automatically collects and analyzes information from an unrivaled breadth of sources
and provides invaluable context in real time and packaged for human analysis orintegration with security technologies.

4CTA-2021-0107

Recorded Future ® | www.recordedfuture.com