Charting the IOCs. A meta-analysis of C2 locations and… | by John F | Jul, 2024 | Medium

Threat actors are actively attempting to exploit our digital infrastructure — often with little to no rules limiting their conduct nor concern for the damage wrought as part of their attacks. I encourage you to consider these threat actors through the lens of being our ‘enemy’ as part of a conflict that spans the Internet and crosses over into our networks. “If you know the enemy and know yourself, you need not fear the result of a hundred battles…” — Sun Tzu, The Art of War The famous quote actually concludes Sun Tzu’s Chapter III: Attack by Stratagem [1]. The chapter encourages comparing the resources, attack surface, and mindset of both you and your enemy (it also has some fascinating insights on siege warfare). I think about our enemies often: Where are they located? How do they carry out attacks against us? and Who supports their efforts? Our enemies configure their malware payloads to call-back to specific command-and-control (C2) servers so that the payloads can upload data and

Threat actors are actively attempting to exploit our digital infrastructure — often with little to no rules limiting their conduct nor concern for the damage wrought as part of their attacks. I encourage you to consider these threat actors through the lens of being our ‘enemy’ as part of a conflict that spans the Internet and crosses over into our networks. “If you know the enemy and know yourself, you need not fear the result of a hundred battles…” — Sun Tzu, The Art of War The famous quote actually concludes Sun Tzu’s Chapter III: Attack by Stratagem [1]. The chapter encourages comparing the