Industry Tool Detects Thousands of C2 Server RATs

A tool developed by two security companies that scans the internet for command and control (C2) servers has already uncovered thousands of malicious RATs, or remote access trojans, on computers and other internet-connected devices.

Shodan, a search engine used by many security researchers, lists information for open ports belonging to internet-connected devices. The company teamed up with threat intelligence firm Recorded Future to integrate a new online crawler into its search engine called Malware Hunter.

Malware Hunter scans the internet regularly over time to identify C2 servers for various malware like RATs. RATs are typically leveraged by hackers with malicious intent to record audio, video and keystrokes, as well as exfiltrate files and more. Malware Hunter can currently detect at least 10 kinds of RATs, including DarkComet, njRAT, Poison Ivy, Ghost RAT and Net Bus.

According to Shodan, it works “by pretending to be an infected client that's reporting back to a C2. Since we don't know where the C2s are located the crawler effectively reports back to every IP on the internet as if the target IP is a C2. If the crawler gets a positive response from the IP then we know that it's a C2.”

Recorded Future released a report, “Proactive Threat Identification Neutralizes Remote Access Trojan Efficacy,” which explains in detail how the tool makes it easier to find the source of malware on C2s that control botnets.

The Hacker News founder and CEO Mohit Kumar tested out Malware Hunter and has already found more than 5,700 malicious C2 servers. He also reports that the United States sits in the top three countries hosting C2 servers, leading at 72 percent, followed by Hong Kong (12 percent) and China (5.2 percent).

Bleeping Computer reported that Malware Hunter will be able to uncover other types of malware botnets besides RATs, such as those for backdoor trojans, DDoS and cryptominers, in the future.

Shodan users can log in with a free account to use the tool.

About the Author

Sri Ravipati is Web producer for THE Journal and Campus Technology. She can be reached at [email protected].

Featured

  • AI robot with cybersecurity symbol on its chest

    Microsoft Adds New Agentic AI Tools to Security Copilot

    Microsoft has announced a major expansion of its AI-powered cybersecurity platform, introducing a suite of autonomous agents to help organizations counter rising threats and manage the growing complexity of cloud and AI security.

  • modern college building with circuit and brain motifs

    Anthropic Launches Claude for Education

    Anthropic has announced a version of its Claude AI assistant tailored for higher education institutions. Claude for Education "gives academic institutions secure, reliable AI access for their entire community," the company said, to enable colleges and universities to develop and implement AI-enabled approaches across teaching, learning, and administration.

  • central cloud platform connected to various AI icons—including a brain, robot, and network nodes

    Linux Foundation to Host Protocol for AI Agent Interoperability

    The Linux Foundation has announced it will host the Agent2Agent (A2A) protocol project, an open standard originally developed by Google to support secure communication and interoperability among AI agents.

  • open laptop in a college classroom with holographic AI icons like a brain and data charts rising from the screen

    4 Ways Universities Are Using Google AI Tools for Learning and Administration

    In a recent blog post, Google shared an array of education customer stories, showcasing ways institutions are using AI tools like Gemini and NotebookLM to transform both learning and administrative tasks.