📡 Synthetic C2 Beaconing

Fake victims that check in to attacker C2, wasting the operator's time and recording their commands.

What it is

Instrumented decoy hosts that check in to an attacker's command-and-control server as fake victims, using the malware's own protocol. The operator spends time on hosts that are not real, and every command sent to a decoy is recorded. It uses a few fake victims, never a flood, and it is an active measure that needs legal approval.

Implementation requirements

• What the evidence supports: fake participants inside live botnets are an established research method. Rossow et al. (IEEE S&P 2013) injected 'sensor' nodes into peer-to-peer botnets to enumerate infected hosts, and Kanich et al. (ACM CCS 2008) ran proxy bots inside the Storm botnet's command-and-control path. Both used a small number of fake participants; neither floods the infrastructure
• Purpose here: when malware is found in your environment, run instrumented decoy hosts that check in to its command-and-control (C2) server as fake victims. The operator spends effort on hosts that are not real, and every command sent to a decoy is recorded
• Source of C2 addresses: only infrastructure observed in malware from your own environment and confirmed by your incident-response team. Never act on third-party threat-feed entries alone
• Run the decoys in an isolated sandbox with a dedicated egress address documented as your organisation's. They reproduce the malware's own check-in protocol and report plausible fake host profiles
• Keep volume low: a handful of fake victims at the malware's normal check-in rate. High-volume traffic to someone else's server is a denial-of-service attack, and C2 servers are often compromised legitimate machines
• Monitoring: record every command or payload the C2 sends to a decoy. Payloads go to malware analysis and are never executed outside the sandbox
• Safety: follow the rule Kanich et al. worked under, that actions stay neutral and no one is left worse off. Time-box every engagement, and stop at once if the C2 turns out to be a compromised third-party machine whose owner has been contacted
• Legal: this sends traffic to infrastructure you do not own. Written legal approval is required before any use; coordinate with your national CERT or law enforcement where a takedown is in progress
• Rollback: stop the decoys and shut down the sandbox. Keep the recorded commands and payloads as evidence
• Upkeep: Time-box every engagement and re-approve at expiry. Stop at once if the C2 server is found to be a compromised third-party machine whose owner has been contacted.

Technologies

Evidence

• SoK: P2PWNED — Modeling and Evaluating the Resilience of Peer-to-Peer Botnets — Rossow, C. et al., IEEE S&P 2013 peer-reviewed
• Spamalytics: An Empirical Analysis of Spam Marketing Conversion — Kanich, C. et al., ACM CCS 2008 peer-reviewed