Industry Tool Detects Thousands of C2 Server RATs

A tool developed by two security companies that scans the internet for command and control (C2) servers has already uncovered thousands of malicious RATs, or remote access trojans, on computers and other internet-connected devices.

Shodan, a search engine used by many security researchers, lists information for open ports belonging to internet-connected devices. The company teamed up with threat intelligence firm Recorded Future to integrate a new online crawler into its search engine called Malware Hunter.

Malware Hunter scans the internet regularly over time to identify C2 servers for various malware like RATs. RATs are typically leveraged by hackers with malicious intent to record audio, video and keystrokes, as well as exfiltrate files and more. Malware Hunter can currently detect at least 10 kinds of RATs, including DarkComet, njRAT, Poison Ivy, Ghost RAT and Net Bus.

According to Shodan, it works “by pretending to be an infected client that's reporting back to a C2. Since we don't know where the C2s are located the crawler effectively reports back to every IP on the internet as if the target IP is a C2. If the crawler gets a positive response from the IP then we know that it's a C2.”

Recorded Future released a report, “Proactive Threat Identification Neutralizes Remote Access Trojan Efficacy,” which explains in detail how the tool makes it easier to find the source of malware on C2s that control botnets.

The Hacker News founder and CEO Mohit Kumar tested out Malware Hunter and has already found more than 5,700 malicious C2 servers. He also reports that the United States sits in the top three countries hosting C2 servers, leading at 72 percent, followed by Hong Kong (12 percent) and China (5.2 percent).

Bleeping Computer reported that Malware Hunter will be able to uncover other types of malware botnets besides RATs, such as those for backdoor trojans, DDoS and cryptominers, in the future.

Shodan users can log in with a free account to use the tool.

About the Author

Sri Ravipati is Web producer for THE Journal and Campus Technology. She can be reached at [email protected].

Featured

  • From Fire TV to Signage Stick: University of Utah's Digital Signage Evolution

    Jake Sorensen, who oversees sponsorship and advertising and Student Media in Auxiliary Business Development at the University of Utah, has navigated the digital signage landscape for nearly 15 years. He was managing hundreds of devices on campus that were incompatible with digital signage requirements and needed a solution that was reliable and lowered labor costs. The Amazon Signage Stick, specifically engineered for digital signage applications, gave him the stability and design functionality the University of Utah needed, along with the assurance of long-term support.

  • Microsoft

    Microsoft Introduces Its First Quantum Computing Chip

    Microsoft has unveiled Majorana 1, its first quantum computing chip, aimed at deployment in datacenters.

  • interconnected glowing nodes and circuits in blue and green, forming a neural network on a dark background with a futuristic design

    Tech Giants Launch $100 Billion AI Infrastructure Network Project

    OpenAI, SoftBank, and Oracle have unveiled a new venture, Stargate, through which they aim to build a massive AI infrastructure network across the United States. The initiative, which was announced at the White House with President Donald Trump, has been described as the "largest AI infrastructure project in history."

  • glowing digital shield with a checkmark in the center, surrounded by interconnected lines and nodes on a dark blue background with subtle circuit patterns

    Navigating CMMC 2.0: New Cybersecurity Standards Impact Higher Education

    In October 2024, the Department of Defense published a new update to its Cybersecurity Maturity Model Certification enforcing new cybersecurity standards on universities and colleges. With Phase 1 beginning this year, here's what the new requirements mean for higher ed.