/
← Voltar ao feed
low

GreyNoise launches C2 Detection to flag compromised edge devices via outbound callback IP matching

1 fonte(s) · 1 atualização(ões) · publicado 06/04/2026 21:00 · coletado há 1 dia

GreyNoise announced C2 Detection, a new intelligence module that identifies compromised edge and perimeter devices (routers, firewalls, VPN concentrators) from their outbound connections to attacker-controlled infrastructure. The capability extends GreyNoise beyond inbound scanning intelligence into post-exploitation, outbound-facing detection. It is a product announcement, not a security incident, and the article names no specific threat actor, vulnerability or campaign. It is available as a dataset add-on for existing customers through the Visualizer and API.

Technical Details

  • GreyNoise reads exploit payloads sent to its global sensor network and extracts the embedded callback destinations. It then collects the malware hosted there and analyzes it to map later attack stages, from staging servers to C2 infrastructure.
  • The output is a continuously updated dataset of confirmed callback IPs and associated malware hashes, with VirusTotal correlation, plus a new callback_ips query parameter.
  • Callback IPs are classified into three stages. Stage 1 is a confirmed file download and Stage 2 is suspected C2 activity. The article does not describe the third stage.
  • Detection workflow: match destination IPs in edge-device egress logs against the callback dataset, enrich SIEM/SOAR playbooks via the API, and investigate historically with time range filters. Callback infrastructure persists for weeks or months, longer than scanning IPs.
  • Two signals indicate compromise. Signal A (existing) is the organization's IP appearing in GreyNoise as a scanner, meaning the device has been recruited into a botnet. Signal B (new) is outbound traffic matching a confirmed callback IP.

Remediation

  • Export egress logs from edge devices and match destination IPs against the callback dataset.
  • Open a case on a Stage 1 match. Escalate and contain immediately on a Stage 2 match.
  • Combine Signal A and Signal B to raise confidence that a device is compromised.

Linha do tempo

  1. greynoise.io ↗ · pub. 06/04/2026 21:00 · coletado 19/10 18:37 primeiro registro

    GreyNoise launches C2 Detection to flag compromised edge devices via outbound callback IP matching

    ler a análise desta fonte

    GreyNoise announced C2 Detection, a new intelligence module that identifies compromised edge and perimeter devices (routers, firewalls, VPN concentrators) from their outbound connections to attacker-controlled infrastructure. The capability extends GreyNoise beyond inbound scanning intelligence into post-exploitation, outbound-facing detection. It is a product announcement, not a security incident, and the article names no specific threat actor, vulnerability or campaign. It is available as a dataset add-on for existing customers through the Visualizer and API.

    Technical Details

    • GreyNoise reads exploit payloads sent to its global sensor network and extracts the embedded callback destinations. It then collects the malware hosted there and analyzes it to map later attack stages, from staging servers to C2 infrastructure.
    • The output is a continuously updated dataset of confirmed callback IPs and associated malware hashes, with VirusTotal correlation, plus a new callback_ips query parameter.
    • Callback IPs are classified into three stages. Stage 1 is a confirmed file download and Stage 2 is suspected C2 activity. The article does not describe the third stage.
    • Detection workflow: match destination IPs in edge-device egress logs against the callback dataset, enrich SIEM/SOAR playbooks via the API, and investigate historically with time range filters. Callback infrastructure persists for weeks or months, longer than scanning IPs.
    • Two signals indicate compromise. Signal A (existing) is the organization's IP appearing in GreyNoise as a scanner, meaning the device has been recruited into a botnet. Signal B (new) is outbound traffic matching a confirmed callback IP.

    Remediation

    • Export egress logs from edge devices and match destination IPs against the callback dataset.
    • Open a case on a Stage 1 match. Escalate and contain immediately on a Stage 2 match.
    • Combine Signal A and Signal B to raise confidence that a device is compromised.