WebRTC Datachannels: C2 That Looks Like a Call Your Firewall Already Allows
SDP on a paste, ICE through NAT, DTLS datachannel tasking. Lab peer plus allowlist and signaling hunts.
C2
Read Full News
Your C2 Is a WebSocket Upgrade and the Proxy Logged It as Chat
101 Upgrade, Origin cosplay, JSON tasking on a long-lived socket. Lab server and implant plus what to alert on.
Your C2 Resolver Is a Public GitHub Gist (and Sometimes a Twitter Bio)
the implant only knows a gist id. githubusercontent hands it the real next hop. your proxy called it developer browsing.
SSH Over ICMP Because Your Firewall Still Thinks Ping Is Harmless
ptunnel-ng turned echo request into a TCP pipe. your allow-list called it diagnostics. the shell called it tuesday.
Your C2 Is a DNS-over-HTTPS Lookup to Cloudflare and Your SIEM Does Not Care
port 53 is closed. the implant asked cloudflare-dns.com for a TXT and got tasking. your proxy logged browsing.
Hide a C2 Beacon Config in a PNG Pixel and Call It a Profile Pic
the implant downloaded a profile pic, flipped the LSBs, and recovered where to phone home. no PE. just pixels. here is the lab and the hunt.