Putting the C2 in C2loudflare | JUMPSEC LABS
Tags
attack-pattern: Data Domains - T1583.001 Domains - T1584.001 Email Addresses - T1589.002 Server - T1583.004 Server - T1584.004 Serverless - T1583.007 Serverless - T1584.007 Software - T1592.002 Ssh - T1021.004 Tool - T1588.002 Sudo - T1169
Show in Graph
Common Information
Type Value
UUID 5ecb20b0-db7f-41b5-b467-2e9ab720b833
Fingerprint e4bbbbd70bd99291
Analysis status DONE
Considered CTI value 0
Text language
Published June 28, 2024, 8:32 a.m.
Added to db Aug. 31, 2024, 6:25 a.m.
Last updated Nov. 19, 2024, 9:52 p.m.
Headline Putting the C2 in C2loudflare
Title Putting the C2 in C2loudflare | JUMPSEC LABS
Detected Hints/Tags/Attributes 43/1/16
Source URLs
Redirection Url
Details Source https://labs.jumpsec.com/putting-the-c2-in-c2loudflare/
URL Provider
Details Provider Source level domain
Details jumpsec.com labs.jumpsec.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 149 ✔ JUMPSEC LABS https://labs.jumpsec.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 51 
cloudflare.com
Details Domain 1 
sliver.yourdomain.com
Details Domain 1 
customworkername.customsubdomain.workers.dev
Details Domain 18 
workers.dev
Details Domain 1 
sliver.mydomain.com
Details Domain 10 
mycompany.com
Details Domain 1 
files.yourdomain.com
Details Domain 1 
redirector.myname.workers.dev
Details File 174 
index.js
Details File 156 
package.json
Details File 1 
ligolosockets.exe
Details IPv4 1444 
127.0.0.1
Details Url 1 
https://sliver.yourdomain.com
Details Url 1 
https://127.0.0.1:443
Details Url 1 
https://files.yourdomain.com
Details Url 1 
https://redirector.myname.workers.dev:443