Spycraft 2.0: Hunting Dead Drops in Web Applications

Spycraft 2.0: Hunting Dead Drops in Web Applications

Speakers: Jonathan Fuller, CISO, United States Military Academy

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=axuZzwJ7xnc

Overview

In "Spycraft 2.0: Hunting Dead Drops in Web Applications," Jonathan Fuller, CISO at the United States Military Academy and an assistant professor specializing in forensics and malware analysis, delves into cutting-edge techniques for disrupting botnets by turning adversaries' own code against them. The talk addresses the persistent challenge of botnet takedowns, which often resemble a "beheading a hydra" scenario, with new command and control (C2) infrastructure quickly emerging after disruptions. Fuller introduces a novel, proactive approach that leverages an understanding of malware's internal logic to identify and neutralize C2 mechanisms, particularly the emerging threat of Dead Drop Resolvers (DDRs).

This presentation is highly relevant to cybersecurity professionals, incident responders, and threat intelligence analysts grappling with sophisticated and evasive malware. Fuller highlights how attackers are increasingly hiding their C2 communications in plain sight within benign web applications, a tactic he dubs "Spycraft 2.0." By dissecting the methods used to identify and extract the de-manipulation "recipes" from such malware, the talk offers a scalable defensive strategy. It transitions from traditional reactive botnet disruption to a proactive model, empowering defenders to predict and neutralize C2 channels before they can fully operationalize.

The core innovation lies in a framework that employs concolic analysis and symbolic expression matching to reverse-engineer the decoding logic embedded within malware. This allows defenders to not only detect active dead drops but also to proactively scan web platforms for similarly encoded C2 information. Fuller's research provides critical insights into the evolving landscape of C2 evasion, offering practical tools and a conceptual shift that can significantly enhance the effectiveness of botnet counteraction efforts.

Background

▶ Watch: Introduction to modern spycraft and botnet takedowns (0:00)

Botnet takedowns and disruptions have historically been an arduous and often incomplete process. Jonathan Fuller likens the challenge to "beheading a hydra," where cutting off one C2 server often leads to two more emerging. Investigations are frequently hampered by incomplete access to the entire C2 infrastructure, including victim systems, malware samples, proxies, and servers. This lack of comprehensive visibility grants adversaries ample time to migrate C2 servers and cover their tracks, severely reducing the effectiveness of disruption efforts.

Fuller outlines four main milestones in traditional botnet disruption:

1. Discovery: Identifying a sufficiently large botnet that warrants a significant response.
2. Monitoring: Profiling the botnet to understand its scope, collect counteraction intelligence, and analyze malware types.
3. Counteraction: Developing and executing techniques to disrupt the botnet.
4. Post-Counteraction Monitoring: Validating the efficacy of the disruption and assessing the remaining scope of infection.

A prominent example cited is Microsoft's efforts against the Trickbot botnet, which grew for nearly half a decade until 2020. Microsoft collected over 100,000 malware samples, analyzed communication routines, and identified 128 C2 servers globally. Through a collaborative international effort, they successfully disrupted 120 of these servers. However, 8 remained active, primarily hosted by bulletproof hosting providers beyond conventional jurisdiction. This case underscores the inherent difficulties and limitations of even large-scale, coordinated takedown operations.

Fuller’s work began by questioning whether more efficient and effective disruption methods existed. Instead of focusing solely on C2 servers and proxies, his team delved into the malware itself, specifically how each bot communicates with its C2 server. The key insight was that bots inherently possess all necessary information for authentication and communication. By tracing this logic within the malware, defenders could potentially repurpose it for their own use, exploiting inherent weaknesses.

This led to the first major discovery: the concept of overpermissioned protocols. Bots often use standard protocols like File Transfer Protocol (FTP) for data transfer or message-based communication. However, these protocols frequently offer a broader range of features than the malware actually implements (e.g., a malware only uses push but the protocol supports push and pull). Attackers prioritize efficiency and ease of use, often selecting protocols known for their insecurities, like FTP, to maximize their return on investment. If defenders can recover the obfuscated credentials baked into the malware, they can use these as infiltration vectors to access the C2 server, operating under the guise of a trusted bot. This initial research, known as the C3PO framework (Covert Command and Control over Over-Permissioned Protocol Infiltration), demonstrated how malware's logic could be "flipped" to turn its capabilities against the adversary. This early work, presented at conferences like SchmooCon and AvengerCon, laid the groundwork for the more advanced "Spycraft 2.0" concepts.

Key Findings

▶ Watch: The four main milestones of botnet disruptions (2:30)

The transition from C3PO to "Spycraft 2.0" was driven by an unexpected finding during malware analysis: some malware samples were observed connecting not directly to a C2 server, but to seemingly benign public web applications like Twitter. While malware sometimes contacts benign sources to test internet connectivity or to obfuscate network traffic, the specific nature of these connections suggested a more sophisticated tradecraft. This observation piqued the researchers' interest, leading them to investigate whether this was an isolated incident or the emergence of a new form of malware evasion.

This new tradecraft was identified as Dead Drop Resolvers (DDRs). Fuller explains that DDRs are the digital equivalent of physical "dead drops" used in traditional espionage, where agents hide information in a public, pre-arranged location for another agent to retrieve. In the digital realm, DDR malware hides C2 server information in plain sight on public web applications such as Twitter, Pastebin, or GitHub. Once infected, a system connects to one of these dead drops, retrieves an often-encoded message, and then decodes it layer by layer to reveal the true C2 IP address or URL before establishing the final connection.

DDRs present significant challenges for defenders due to several characteristics:

• Anonymity and Elasticity: Attackers have an endless supply of public channels, allowing them to create disposable accounts easily without stringent verification.
• Unpredictable Endpoints: Each dead drop can be easily replaced, making traditional blocklisting ineffective.
• Harmless-Looking Traffic: The initial traffic to a dead drop appears as ordinary HTTPS requests to legitimate sites, making it indistinguishable from normal user activity. Enterprises cannot simply block major platforms like Twitter or GitHub.
• Multi-Layered Messages: The C2 messages themselves are often multi-layered and encoded, making brute-force decryption impractical.
• Persistence: As seen with a specific Twitter handle identified in their research, web platforms may struggle to take down accounts flagged for malicious use, especially if the content isn't immediately "offensive" in a conventional sense.

Fuller emphasizes that DDRs represent an evolution from older dynamic C2 resolution techniques like fast flux networks or Domain Generation Algorithms (DGAs). While fast flux can be easily blocklisted and DGAs can be reverse-engineered to predict future domains, DDRs leverage the perceived legitimacy and vastness of public web applications to evade detection. The core finding is that despite this advanced evasion, malware authors still hand over a critical bit of control to these web applications, creating an opportunity for defenders to "pounce" by reusing the malware's own logic for counteraction. The goal is to turn the invisible nature of DDR malware visible again, understanding what's happening in this new "digital spycraft" world.

Technical Deep Dive

▶ Watch: Case study: Microsoft's extensive Trickbot takedown (4:00)

To counteract DDR malware, Jonathan Fuller and his team developed a framework based on three key insights, focusing on extracting the malware's embedded de-manipulation logic.

Key Insight 1: Decoding Logic is Baked In.

DDR malware must, by definition, decode the C2 address it retrieves from the dead drop before it can use it. This means the malware contains the specific decoding (or decryption) logic within its compiled code. If investigators can understand and extract this de-manipulation logic, they could potentially use it to scan web platforms for similarly encoded content, proactively revealing C2 IPs or URLs. However, operationalizing this insight proved tricky. Malware authors often obfuscate their DDR routines, producing a "tangle" of network connections. Furthermore, the decoding logic often exists as complex mathematical representations within compiled binaries, not as easily extractable source code, making simple "copy-paste" impossible.

Key Insight 2: Localizing DDR Routines.

The challenges of the first insight led to the realization that DDR routines could be localized based on content fetching and content use. Investigators can observe network connections to web applications (content fetching) followed by subsequent connections (content use). By profiling the specific point where the malware connects to the web app and then tracking the information flow throughout the malware's execution, the specific code segment responsible for DDR can be isolated.

Key Insight 3: Symbolic Expressions for Algorithm Matching.

Even after isolating the logic, identifying the specific decoding algorithms used (e.g., Base64, character rotation) remains a challenge. The third insight proposes that de-manipulation routines, when analyzed using symbolic execution, reduce to symbolic expressions. These are essentially arithmetic and logical operations that describe how a program path is traversed. If defenders can generate symbolic expressions for known algorithms (e.g., Base64) and compare them to the symbolic expressions extracted from the malware, they can identify matching de-manipulation "recipes."

Framework Macro Level:

The framework operates in stages:

1. DDR Logic Localization: The process begins by identifying the initial connection to a web application that retrieves the dead drop content. This often occurs early in malware execution, right after unpacking or de-obfuscation. A common technique is to set a breakpoint at the first network connection (e.g., InternetOpenA, HttpOpen, SocketOpen) during dynamic analysis, as this usually signifies that the malware has unpacked itself and is ready to execute its payload.
2. De-manipulation Boundary Isolation: Once the initial web app connection and the subsequent C2 connection are identified, the framework focuses on the code segment between these two points. This "boundary" is where the decoding logic must reside, transforming the raw dead drop content into a functional C2 address.

Framework Micro Level: Concolic Analysis and Recipe Identification:

The core of the technical deep dive involves concolic analysis, a hybrid approach combining concrete execution (running the malware normally) and symbolic execution (treating input values as symbols rather than concrete data). Tools like S2E (or alternatives like Angr + Symbion) can be used for this.

1. Symbolic Data Injection: The malware is executed. When it attempts to read data from a web application (e.g., WordPress), instead of providing actual data from the web, the framework injects symbolic data. This is akin to taint propagation or symbolic tagging, where a unique identifier (e.g., sim_tag_1) is attached to the memory buffer containing the received data. This allows the framework to track the flow of this "tainted" information.
2. Information Flow Tracking: The framework continuously monitors for subsequent outbound network connections. If a target within an InternetConnectA call contains the previously injected sim_tag, it confirms that the data read from the web app was used to establish a subsequent outbound connection – a clear indicator of DDR malware.
3. De-manipulation Boundary Refinement: Within the identified DDR capability, the framework refines the de-manipulation boundary. The decoding must occur somewhere between the symbolic data injection and its use for the C2 connection.
4. Recipe Identification through Input-Output Mapping:

• As the malware executes and processes the symbolic data, the framework halts execution whenever a value containing the symbolic tag is accessed.
• At each halt, the current symbolic expression representing the data's state is "concretized" (solved to a concrete value).
• This concrete value is then fed as input to a predefined set of known decoding algorithms (e.g., Base16, Base64, character rotation, XOR, AES, etc.). The outputs of these known algorithms are recorded.
• The malware's execution resumes. When it next accesses the symbolic data (now in a transformed state), its new concrete value is compared against the previously recorded outputs of the known algorithms.
• If a match is found (e.g., the current value matches the output of a "character rotate" algorithm when given the previous value as input), then the framework deduces that the "character rotate" algorithm was applied between the two halt points.
• This iterative process allows the framework to localize each decoding step (e.g., "character rotate occurred between lines 2 and 5") and identify the entire de-manipulation recipe (e.g., Base16 followed by character rotation).

1. Symbolic Expression Comparison: Finally, with individual decoding steps localized, the symbolic expressions for each step extracted from the malware can be compared directly to the symbolic expressions of known algorithms. This "apples-to-apples" comparison ensures accurate identification of the algorithms, even if their implementations in the malware are slightly different from standard versions (e.g., a table lookup vs. inline mathematical computation for Base16). This results in the extraction of a precise de-manipulation recipe.

This concolic analysis-driven approach provides a scalable method for analyzing DDR malware and extracting these crucial de-manipulation recipes, which can then be used for proactive dead drop discovery.

Demo / Proof of Concept

▶ Watch: The core insight: Exploiting malware's inherent logic (6:21)

The practical application of the framework was demonstrated using the Muddrop malware as a running example. The framework successfully identified that Muddrop connected to a WordPress site, retrieved a random string of characters (the dead drop content), applied a de-manipulation recipe of Base16 decoding followed by character rotation, and then used the resulting IP address to connect to its C2 server. This confirmed the malware's DDR capabilities and validated the recipe extraction process.

With the ability to extract these recipes, the researchers moved to recipe scanning — using the identified de-manipulation logic to proactively scan public web application platforms for similarly encoded content. While acknowledging limitations like API throttling, this proof-of-concept showed significant effectiveness. From just one known dead drop, the framework was able to identify three previously unknown dead drops. These newly found dead drops, when their decoded C2 addresses were submitted to VirusTotal URL/Host, confirmed their maliciousness.

A large-scale study was conducted on 100,000 malware samples captured over a decade. Due to the computational intensity of concolic analysis, a 15-minute timeout was set for each sample. Key findings from this large-scale analysis include:

• Prevalence: Approximately 9% of the malware samples in the dataset were identified as DDR malware.
• Web Applications: Seven unique web applications were observed hosting dead drops.
• Pastebin Dominance: Pastebin was found to be the most prominent web application used for dead drops. While Pastebin has long been associated with malicious activities (e.g., hosting droppers or scripts), this research is among the first to expose its pervasive use for hosting dead drops specifically.
• Blockchain Explorers: A significant 25% of the identified DDR malware utilized blockchain explorers (e.g., for Bitcoin or Ethereum) to host C2 addresses. The immutability of blockchains makes this a highly robust C2 hosting method, as transactions cannot be removed. Malware would often use the values from recent transactions (e.g., a few cents) and convert them into IP addresses. A countermeasure demonstrated was sinkholing the C2 by posting new transactions to the same wallet, effectively redirecting new malware connections to a defender-controlled server. However, attackers can easily counter by posting new transactions themselves.
• Hybrid DGA/DDR: Three instances of dynamically generated Twitter accounts were found. These samples employed a DGA algorithm to randomly generate Twitter account names, register them, and then use them as dead drops. While a novel hybrid approach, the DGA component means traditional DGA reverse engineering techniques can still be applied for proactive blocking.
• Traffic Analysis: Beyond scanning web apps, the framework was applied to a Netresec PCAP dataset. This scan identified 72 new dead drops hosted across 11 web applications by analyzing network traffic content.
• Encoding Complexity: While Base64 was a common encoding method (also observed in PowerShell obfuscation), a crucial finding was that 60% of the dead drops not using Base64 employed multi-layered encoding approaches. This highlights why brute-forcing alone is not a tractable solution for DDR detection.
• C2 Server Reuse: The study identified 67 reused C2 servers, indicating that attackers are frequently re-encoding the same C2s across different web app platforms. This suggests that web app providers struggle to identify and remove dead drops, with 60% of dead drops protecting C2 servers remaining available during the study period.

The real-world impact was significant: from the dead drops identified in the Netresec dataset, the researchers were able to request remediation, and 80% of those dead drops were successfully removed, directly affecting the malware relying on them. This demonstrates a move beyond reactive measures towards proactive remediation, improving detection by 57% and enabling collaboration with web app providers to take down malicious posts.

Defensive Implications

▶ Watch: Understanding overpermissioned protocols in malware communication (7:35)

The "Spycraft 2.0" research presents a paradigm shift in botnet counteraction, offering several critical defensive implications:

1. Malware Logic Reuse is a Viable Strategy: Defenders can and should actively seek to reuse the adversary's own malware logic for counteraction. Instead of merely analyzing malware behavior for detection, the goal should be to extract intelligence that can be directly weaponized against the threat actors. The framework presented demonstrates that the very routines built by adversaries to control victims can become tools for disruption.
2. Proactive Dead Drop Discovery and Remediation: The ability to extract de-manipulation recipes from DDR malware empowers defenders to move from reactive blocklisting to proactive scanning. By leveraging these recipes, web application platforms and network traffic can be scanned to identify and remediate previously unknown dead drops before they cause widespread infection. This allows for disruption of C2 infrastructure at an earlier stage, potentially before it even goes "live" for a significant period.
3. Enhanced Detection Capabilities for Web App Providers: The research provides a concrete methodology for web application providers to enhance their threat detection. Fuller noted that many platforms already scan for illicit content (e.g., child sexual abuse material). This framework suggests extending these existing scanning capabilities to identify malicious artifacts and Indicators of Compromise (IoCs) related to botnets, specifically DDRs. This enables platforms to take down malicious posts and accounts more effectively, as demonstrated by the 80% remediation success rate.
4. Addressing Evasive C2 Techniques: DDRs represent a significant evolution in C2 evasion, blending in with legitimate traffic and leveraging the perceived trustworthiness of popular platforms. Understanding the technical intricacies of DDRs, including their use of multi-layered encoding, blockchain explorers, and hybrid DGA approaches, is crucial for developing robust defenses against these sophisticated tactics.
5. Scalable and Sustainable Defense: The concolic analysis framework offers a scalable approach to analyzing DDR malware. While computationally intensive for individual samples, the extracted recipes can be applied broadly for platform and traffic scanning, providing a sustainable defense mechanism that can adapt to new dead drop variations. This enables web app providers to detect and remediate threats early, reducing the overall attack surface.
6. Intelligence for Counteraction: Studying malware should not solely be about understanding the threat or publishing findings, but about gaining actionable intelligence for counteraction. By deeply analyzing how malware operates, defenders can identify critical weaknesses and pivot points to turn the tables on attackers.

In essence, "Spycraft 2.0" illustrates that the most effective defense against modern, evasive C2 techniques may reside within the adversary's own code, waiting to be repurposed.

Key Takeaways

• Botnet Disruption Challenges: Traditional botnet takedowns are often reactive, incomplete, and resemble a "hydra" where new C2s quickly emerge, highlighting the need for more proactive and effective strategies.
• Malware Logic Reuse: Defenders can repurpose the adversary's own malware logic, specifically its authentication and communication routines, to infiltrate C2 infrastructure and turn its capabilities against itself, as demonstrated by the C3PO framework.
• Emergence of Dead Drop Resolvers (DDRs): "Spycraft 2.0" involves malware hiding C2 information in benign, public web applications (e.g., Twitter, Pastebin, blockchain explorers) to evade detection, making C2 traffic appear legitimate.
• Concolic Analysis for Recipe Extraction: A sophisticated framework using concolic analysis, symbolic data injection, and input-output mapping can effectively extract multi-layered de-manipulation "recipes" (sequences of decoding algorithms) from DDR malware.
• Proactive Dead Drop Discovery: These extracted recipes enable proactive scanning of web platforms and network traffic, leading to the identification of previously unknown dead drops and their associated C2 servers, significantly improving detection rates.
• Empowering Web App Providers: Web application providers can leverage these technical insights and tools to extend their existing content scanning capabilities, enhancing their ability to identify and remediate malicious content and disrupt C2 infrastructure early.

About the Speaker(s)

Jonathan Fuller is the CISO (Chief Information Security Officer) at the United States Military Academy. In addition to his leadership role in cybersecurity, he also serves as an assistant professor in the Electrical Engineering and Computer Science department. His research and professional interests lie in the fields of forensics and malware analysis, which form the core of the innovative work presented in this talk. His background uniquely positions him to bridge the gap between academic research in malware analysis and practical, real-world defensive strategies against sophisticated cyber threats.