Skip to main content
Add as a preferred source on Google


Industry Tool Detects Thousands of C2 Server RATs

A tool developed by two security companies that scans the internet for command and control (C2) servers has already uncovered thousands of malicious RATs, or remote access trojans, on computers and other internet-connected devices.

Shodan, a search engine used by many security researchers, lists information for open ports belonging to internet-connected devices. The company teamed up with threat intelligence firm Recorded Future to integrate a new online crawler into its search engine called Malware Hunter.

Malware Hunter scans the internet regularly over time to identify C2 servers for various malware like RATs. RATs are typically leveraged by hackers with malicious intent to record audio, video and keystrokes, as well as exfiltrate files and more. Malware Hunter can currently detect at least 10 kinds of RATs, including DarkComet, njRAT, Poison Ivy, Ghost RAT and Net Bus.

According to Shodan, it works “by pretending to be an infected client that's reporting back to a C2. Since we don't know where the C2s are located the crawler effectively reports back to every IP on the internet as if the target IP is a C2. If the crawler gets a positive response from the IP then we know that it's a C2.”

Recorded Future released a report, “Proactive Threat Identification Neutralizes Remote Access Trojan Efficacy,” which explains in detail how the tool makes it easier to find the source of malware on C2s that control botnets.

The Hacker News founder and CEO Mohit Kumar tested out Malware Hunter and has already found more than 5,700 malicious C2 servers. He also reports that the United States sits in the top three countries hosting C2 servers, leading at 72 percent, followed by Hong Kong (12 percent) and China (5.2 percent).

Bleeping Computer reported that Malware Hunter will be able to uncover other types of malware botnets besides RATs, such as those for backdoor trojans, DDoS and cryptominers, in the future.

Shodan users can log in with a free account to use the tool.

About the Author

Sri Ravipati is Web producer for THE Journal and Campus Technology. She can be reached at [email protected].

Featured

  • Students using laptops in classroom

    Stop Asking Whether Students Can Use AI

    As generative AI has become embedded in the tools students use to search, write, create, translate, organize, and receive feedback, the boundary between "using AI" and "not using AI" has become increasingly difficult to define. More importantly, treating AI use as a binary choice does little to help students understand the different roles AI can appropriately play in learning.

  • children using smart phones

    With Little Federal Guidance, States Take on Screen Time Themselves

    As an umbrella term, education technology encompasses everything from learning management systems and student information systems to productivity tools and AI platforms. More specific language clarifying the difference between ed tech and consumer-facing tools would allow state leaders to match the right evidence, expertise, and policy to the right questions.

  • young man hand working on a laptop, bokeh blurred at night

    Redesigned Microsoft Copilot Will Build Apps and Work on Its Own

    Microsoft has announced that it's redesigning Copilot, the company's all-encompassing AI assistant, so users can hand off complex tasks, build tools by describing what they need and assign work to an agent that keeps going after they log off.

  • Abstract Network of Blue and Orange Lines

    Tech Industry Leaders Launch Alliance for AI Agent Security

    NVIDIA and 36 other industry partners are targeting agent security across multi-vendor clouds by combining open technologies for workload identity, agent controls, vulnerability scanning, and software supply-chain security.