Xavier Mertens
Xavier Mertens is a freelance security consultant running his own company based in Belgium (Xameco). With 15+ years of experience in information security, Xavier finds “blue team” activities more attractive. Therefore, his day job focuses on protecting his customers' assets by providing services like incident handling, malware analysis, forensic investigations, log management, security visualization, and OSINT). Besides his day job, Xavier is also a Senior Handler at the SANS Internet Storm Center, Principal SANS Instructor (FOR610, FOR710), security blogger and co-organizer of the BruCON security conference.
Session
Since malware evolved with time, they established communications with a server to work smoothly. Most of them always used the gold old “client/server” model. Before diving into the malware ecosystem, I'll explain why threat actors just reused communications channels that we have for thousands of years. Their goal remains the same except that, today, bits and bytes are used.
That’s the basics of a botnet where we have “bots” waiting for commands from their master. I’ll provide a recap of the C2 protocols from the past to today and... tomorrow? To show you common tactics used by attackers to interact with the infected computers.