Skip to navigation

Threat reportThreat IntelligenceTL-2026-4978

Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)

lowMONITORING

Embee Research documents practical FOFA search queries that fingerprint malware command-and-control servers by TLS certificate values, favicon hashes and HTML titles. The queries cover AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic and Supershell. This is a hunting-technique reference; no CVE, named actor or active exploitation is reported. First disclosed .

Key facts for FOFA C2 hunting queries

IdentifiersTL-2026-4978
Also known asFOFA C2 hunting queries
SeverityLOW
First disclosed
Exploitation statusNo known exploitation
Affected productsN/A Organizations exposed to AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic and Supershell C2 infrastructure
MalwareAmadey - S1025, AsyncRAT, Cobalt Strike, LaplasClipper, Quasar RAT, Smoke Loader - S0226, Supershell
ToolsCobalt Strike, Mythic - S0699, Sliver - S0633
MITRE ATT&CK techniquesT1071.001 Application Layer Protocol: Web Protocols, T1219 Remote Access Tools, T1566 Phishing, T1573.002 Encrypted Channel: Asymmetric Cryptography, T1583.003 Acquire Infrastructure: Virtual Private Server, T1588.001 Obtain Capabilities: Malware, T1588.002 Obtain Capabilities: Tool, T1595 Active Scanning, T1596.005 Search Open Technical Databases: Scan Databases
MotivationUNKNOWN
Target sectorscross-sector, finance, technology
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for FOFA C2 hunting queries

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4978 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TLS Certificate Fingerprints of Known C2 Frameworks (AsyncRAT, Quasar, Cobalt Strike, Sliver, Mythic, Amadey, Laplas)

TL-2026-4978: matches Zeek TLS handshakes whose subject or issuer carries the default certificate values used to fingerprint C2 servers in the Embee FOFA queries: AsyncRAT Server, Quasar Server CA, Major Cobalt Strike / cobaltstrike, multiplayer+operators (Sliver), O=Mythic, desas.digital (Amadey) and Laplas.app (Laplas Clipper). Gives defenders an egress-side view of the same pivots used to hunt this infrastructure (T1573.002, T1071.001, T1588.001, T1588.002).

Splunk SPL

index=zeek sourcetype="bro:ssl:json" earliest=-24h (subject="*AsyncRAT Server*" OR issuer="*AsyncRAT Server*" OR subject="*Quasar Server CA*" OR issuer="*Major Cobalt Strike*" OR issuer="*cobaltstrike*" OR subject="*desas.digital*" OR subject="*Laplas.app*" OR issuer="*O=Mythic*" OR (subject="*multiplayer*" AND issuer="*operators*")) | eval cert=lower(coalesce(subject,"")." ".coalesce(issuer,"")) | eval c2_family=case(like(cert,"%asyncrat server%"),"AsyncRAT", like(cert,"%quasar server ca%"),"Quasar RAT", like(cert,"%cobalt strike%") OR like(cert,"%cobaltstrike%"),"Cobalt Strike", like(cert,"%desas.digital%"),"Amadey", like(cert,"%laplas.app%"),"Laplas Clipper", like(cert,"%mythic%"),"Mythic", like(cert,"%multiplayer%") AND like(cert,"%operators%"),"Sliver", true(),"unknown") | rename id.orig_h as src_ip, id.resp_h as dest_ip, id.resp_p as dest_port | stats count min(_time) as first_seen max(_time) as last_seen values(server_name) as sni by src_ip, dest_ip, dest_port, c2_family | convert ctime(first_seen) ctime(last_seen) | table src_ip dest_ip dest_port c2_family sni count first_seen last_seen

Microsoft KQL

Corelight_v2_ssl_CL
| where TimeGenerated > ago(24h)
| extend cert = tolower(strcat(subject_s, ' ', issuer_s))
| where cert has_any ('asyncrat server','quasar server ca','major cobalt strike','cobaltstrike','desas.digital','laplas.app','o=mythic') or (cert has 'multiplayer' and cert has 'operators')
| extend c2_family = case(cert has 'asyncrat server','AsyncRAT', cert has 'quasar server ca','Quasar RAT', cert has_any ('cobalt strike','cobaltstrike'),'Cobalt Strike', cert has 'desas.digital','Amadey', cert has 'laplas.app','Laplas Clipper', cert has 'mythic','Mythic', 'Sliver')
| project TimeGenerated, SrcIp = id_orig_h_s, DestIp = id_resp_h_s, DestPort = id_resp_p_d, server_name_s, c2_family, subject_s, issuer_s
| order by TimeGenerated desc

Sigma

title: TLS Certificate Matching Known C2 Framework Defaults
id: a94d3e70-1c58-4b2f-b6d9-0e7f5a2c8d03
status: experimental
description: Detects TLS sessions whose certificate subject or issuer matches default values of AsyncRAT, Quasar RAT, Cobalt Strike, Sliver, Mythic, Amadey and Laplas Clipper C2 servers (TL-2026-4978).
references:
    - https://www.embeeresearch.io/threat-intel-queries-with-fofabot/
    - https://team-cymru.com/post/mythic-case-study-assessing-common-offensive-security-tools
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
    - attack.command_and_control
    - attack.t1573.002
    - attack.t1071.001
    - attack.resource_development
    - attack.t1588.001
    - attack.t1588.002
    - attack.tool.cobalt_strike
    - attack.tool.sliver
    - attack.tool.mythic
logsource:
    product: zeek
    service: ssl
detection:
    selection_subject:
        subject|contains:
            - 'AsyncRAT Server'
            - 'Quasar Server CA'
            - 'desas.digital'
            - 'Laplas.app'
    selection_issuer:
        issuer|contains:
            - 'AsyncRAT Server'
            - 'Major Cobalt Strike'
            - 'cobaltstrike'
            - 'O=Mythic'
    selection_sliver:
        subject|contains: 'multiplayer'
        issuer|contains: 'operators'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or purple team exercises using default framework certificates
    - Security researchers and sandboxes connecting to these frameworks
level: high

Known false positives:

  • Authorized red team or purple team engagements using default Cobalt Strike, Sliver or Mythic certificates
  • Researchers or sandboxes intentionally contacting these frameworks

Tuning notes: Adjust index, sourcetype and field names (subject, issuer, id.*) to your Zeek/Corelight ingest; the KQL assumes Corelight_v2_ssl_CL column names. Allowlist red-team source ranges and consider adding the AsyncRAT certificate SHA256 136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe via the Zeek x509 certificate fingerprint field if logged. Certificate strings are leads, not verdicts: corroborate with SPL-001/KQL-003 endpoint telemetry.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Linux Download-and-Execute From Temp Directories (Supershell Implant Deployment) · unlock with TL Creds
  • Run Key or Startup Folder Persistence From User-Writable Path (AsyncRAT / Quasar RAT / Amadey) · unlock with TL Creds
  • Non-Browser Connection To Default C2 Ports or Community-Observed C2 IPs (AsyncRAT, Mythic, Sliver) · unlock with TL Creds
  • Script Host Executing From Downloads, Temp or AppData (Loader Delivery for Amadey / SmokeLoader / Laplas Clipper) · unlock with TL Creds
  • Defender Exclusion For User-Writable Path via PowerShell or reg.exe (Amadey / AsyncRAT Post-Exploitation) · unlock with TL Creds
  • HTTP POST To .php or Payload Download From Bare IP Host (Amadey Bot C2 Check-in and Follow-on Tasking) · unlock with TL Creds
  • Office or Script Host Spawning Downloader Shell (SmokeLoader / Amadey / AsyncRAT / Quasar RAT Delivery) · unlock with TL Creds
  • Scheduled Task or Run-Key Persistence From User-Writable Path via schtasks/reg.exe (AsyncRAT / Amadey / Quasar RAT) · unlock with TL Creds

Indicators of compromise for FOFA C2 hunting queries

As of 2026-11-01, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-4978.

Sample indicators (3 of 14)

  • IP address: 185.196.9[.]158
  • Domain: desas[.]digital
  • File hash: 136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

14 indicators of compromise · unlock with TL Creds. Compare plans

How FOFA C2 hunting queries works

The Embee Research article (author credited as Matthew, dated 2024-01-01) shows how defenders can use the FOFA internet-scanning search engine to locate C2 infrastructure for eight malware families and frameworks. The approach relies on the fact that many operators deploy default or tell-tale configurations. These leave searchable artifacts such as self-signed TLS certificate subject/issuer values, favicon hashes of web panels, and HTML page titles.

Queries published in the article: AsyncRAT - cert.subject.cn or cert.issuer.cn equal to "AsyncRAT Server". Cobalt Strike - cert.issuer.cn="Major Cobalt Strike" and cert.issuer.org="cobaltstrike". Amadey Bot - cert.subject.cn="desas.digital". Quasar RAT - cert.subject.cn="Quasar Server CA". Laplas Clipper - cert.subject.cn="Laplas.app" and icon_hash="1123908622". Sliver - cert.subject.cn="multiplayer" && cert.issuer.cn="operators". Mythic - icon_hash="-859291042" and title=="Mythic". Supershell botnet - icon_hash="-1010228102" and title="Supershell".

Corroborating public research supports the approach. Censys (2026-01-29) found 57 exposed AsyncRAT hosts, 98% of which used the default "AsyncRAT Server" certificate (a Chinese-localized variant also exists), commonly on ports 8808, 6606 and 7707, hosted mostly on budget VPS providers; one host ran several instances on sequential ports. Team Cymru found about 90% of internet-facing Mythic servers kept default settings, including port 7443 and an "O=Mythic" certificate issuer. Sliver exposes a gRPC multiplayer interface on port 31337. Cyble documented Laplas Clipper (180+ samples since 2022-10-24) distributed via SmokeLoader, a clipboard-hijacking crypto clipper that registers with its C2 via GET request using an XOR-encrypted guid/key. Amadey is a modular malware-as-a-service loader and botnet sold on Russian-language forums since 2018 that communicates over HTTP POST to .php C2 paths and drops follow-on payloads. AhnLab ASEC reports Supershell, a Chinese-language web-based reverse-shell C2 panel, deployed against poorly managed Linux SSH servers.

The article lists no concrete victim, campaign or IOC server values; the IOCs recorded here are the detection artifacts (certificate values, favicon hashes, titles) and the sourced Censys example host. These are infrastructure-hunting pivots and should be validated against current scan data before blocking, since certificate strings and favicons can also be used by legitimate red teams and researchers.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools; T1573.002 Encrypted Channel: Asymmetric Cryptography

Initial Access

T1566 Phishing

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.001 Obtain Capabilities: Malware; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1595 Active Scanning; T1596.005 Search Open Technical Databases: Scan Databases

Remediation for FOFA C2 hunting queries

Immediate actions

  • Run the published FOFA, Shodan and Censys certificate, favicon and title pivots against your own external attack surface and against suspect IPs found in telemetry
  • Alert on outbound TLS to hosts presenting certificates with CN/issuer values such as 'AsyncRAT Server', 'Quasar Server CA', 'Major Cobalt Strike', 'multiplayer'/'operators' or O=Mythic
  • Review egress logs for connections to ports commonly used by these frameworks (AsyncRAT 8808/6606/7707, Mythic 7443, Sliver 31337)

Workarounds

  • Treat certificate and favicon matches as leads requiring corroboration, since red teams and researchers also run these frameworks

Longer-term hardening

  • Feed internet-scan-derived C2 candidates into threat-intel platforms with expiry and validation to limit false positives
  • Deploy TLS inspection or JA3/JA4 and certificate-metadata logging on egress
  • Harden Linux SSH servers (key-only auth, no weak passwords) to prevent Supershell-style implant deployment

Affected and fixed versions

  • N/A — Organizations exposed to AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic and Supershell C2 infrastructure

Timeline of FOFA C2 hunting queries

  • locked-ioc-11 bot first seen (October 2018); later sold as a malware-as-a-service loader on Russian-language forums
  • Cyble observes the first of 180+ locked-ioc-2 samples, distributed via locked-ioc-6
  • locked-ioc-2 campaign publicly reported (Cyble, The Hacker News, anti-malware.ru)
  • Embee Research publishes earlier practical queries for locked-ioc-11, locked-ioc-10, locked-ioc-5, QakBot, locked-ioc-8 and locked-ioc-12 infrastructure
  • Embee Research publishes locked-ioc-14 queries for locked-ioc-10, locked-ioc-5, locked-ioc-11, locked-ioc-8, locked-ioc-2, locked-ioc-12, locked-ioc-13 and locked-ioc-9 C2 infrastructure
  • Censys reports 57 exposed locked-ioc-10 hosts, 98% using the default 'locked-ioc-10 Server' certificate, including a Chinese-localized certificate variant

Sources cited for FOFA C2 hunting queries

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats