Brad2025-06-13 (Friday): Traffic analysis exercise: It's a trap!
https://www.malware-traffic-analysis.net/2025/06/13/index.html
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲@malware_traffic There's some unknown but interesting C2 traffic going on to net 104.16.0.0/13 (on CloudFlare). An HTTP POST is sent every 30 seconds (see Gantt chart) with gz compressed data.
The C2 servers use domain names like:
🔥 event-time-microsoft[.]org
🔥 windows-msgas[.]com
🔥 event-datamicrosoft[.]live
🔥 eventdata-microsoft[.]live
They also use this trycloudflare.com domain:
🔥 varying-rentals-calgary-predict.trycloudflare[.]com
Anyone knows what malware this is?
Ian Campbell@netresec trying to sneak a bite in between meetings, but merry giftmas, here's domain and DNS data on the four initial domains in case ya need it
@neurovagrant Thanks for sharing Ian!!