Security

Industry Tool Detects Thousands of C2 Server RATs

• By Sri Ravipati
• 05/02/17

A tool developed by two security companies that scans the internet for command and control (C2) servers has already uncovered thousands of malicious RATs, or remote access trojans, on computers and other internet-connected devices.

Shodan, a search engine used by many security researchers, lists information for open ports belonging to internet-connected devices. The company teamed up with threat intelligence firm Recorded Future to integrate a new online crawler into its search engine called Malware Hunter.

Malware Hunter scans the internet regularly over time to identify C2 servers for various malware like RATs. RATs are typically leveraged by hackers with malicious intent to record audio, video and keystrokes, as well as exfiltrate files and more. Malware Hunter can currently detect at least 10 kinds of RATs, including DarkComet, njRAT, Poison Ivy, Ghost RAT and Net Bus.

According to Shodan, it works “by pretending to be an infected client that's reporting back to a C2. Since we don't know where the C2s are located the crawler effectively reports back to every IP on the internet as if the target IP is a C2. If the crawler gets a positive response from the IP then we know that it's a C2.”

Recorded Future released a report, “Proactive Threat Identification Neutralizes Remote Access Trojan Efficacy,” which explains in detail how the tool makes it easier to find the source of malware on C2s that control botnets.

The Hacker News founder and CEO Mohit Kumar tested out Malware Hunter and has already found more than 5,700 malicious C2 servers. He also reports that the United States sits in the top three countries hosting C2 servers, leading at 72 percent, followed by Hong Kong (12 percent) and China (5.2 percent).

Bleeping Computer reported that Malware Hunter will be able to uncover other types of malware botnets besides RATs, such as those for backdoor trojans, DDoS and cryptominers, in the future.

Shodan users can log in with a free account to use the tool.