About a year ago I started using services like Team Cymru SCOUT (and later others as well, Validin and Censys) to connect C2 IP's via their NetBIOS names exposed via RDP or SMB to the Internet (and scanning services).
Unfortunately I have quite limited resources to work on this research (by myself) and wish for some kind of sharing and collaboration group to join efforts with others interested. The goal should be to track more TACs, TAs and TGs, "impose cost" (as Andrew Thompson would say 😉), and eventually (possibly) identify actors and involve LEA to ultimately lead to arrests of cyber criminals.
If you're interested in tracking threat activity clusters and research C2 infrastructure then I would be interested in hearing from you and invite you to join the sharing and collaboration group.
Connect with me on LinkedIn or Twitter (or via email or Slack if you find me there).
This is just a preliminary post that may get updated with some more details soon(-ish)™.
Twitter announcement: https://TWITTER.com/c_APT_ure/status/1973476746717696501
Update 2026-07-23
I'm currently tracking just over 80 NetBIOS-clusters with one to many C2-IPs linked to them, which have been used to host (mostly) RAT malware C2.
Call for action:
I'm still looking for (more) collaboration trying to connect malware C2 domains or IPs to any publicly (or privately) known TAs or TGs.
If you want to have a quick check on your sources, the
list of IOCs is here.
Related work:
- Just recently I found out about the great research and publications "Hiding in Plain Sight: Tracking Bulletproof Hosting and Abused RDP Infrastructure" from Himaja Motheram at Censys ARC.
- Blog post
- Presentation video on Youtube (BlackHat Europe 2025)
- ...
If you know of other closely related work, please let me know!
Just to give you an idea of the NetBIOS-names and number of associated C2 domains, IPs and sample hashes, here's a quick overview. If you want the raw data, I'm happy to share, just reach out to me.
(PS: IPs-2 are discovered via pDNS from C2 domains, not directly linked to NetBIOS-name like IPs-1)
