Flying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
summary
Demonstrates three concrete C2 builds and attack chains: Post Office (EWS mail C2 using stolen Outlook creds, WinINet/NTLM, hiding tasking in X-headers and relaying via SendGrid), Addendum (VirusTotal metadata channel for static stages by embedding payloads in Office doc properties), and Cloud Racoon (automated AWS/Azure/GCP IP cycling to claim orphan DNS targets; used in production for 6–8 months with ~20 rotating IPs). Covers SQS/AppSpot/S3/CloudFront primitives, CNAME and nameserver takeover mechanics, and proofed demos and released tooling.
AI-written summary · about
chapters (23)
- 0:00Start
- 13:28channel - http pipelining
- 13:52channel - http:websocket
- 14:26[ channel - http/2] HEADERS frame
- 14:55layers
- 16:30channel - icmp +
- 18:35trusted assets
- 19:12trusted abuse
- 20:26poc - postoffice
- 24:18poc - addendum
- 26:36the "cloud"
- 27:14the "issue"
- 29:31abuse - fronting
- 30:43[ abuse - file hosting ] • Hosting static payloads in containers
- 31:43abuse - serverless code
- 32:26takeover primitives
- 34:56ip hunting concept
- 35:35record sets
- 37:01poc - cloud racoon
- 39:38key points
- 40:43what wasn't covered
- 41:34additional resources
- 42:14finish
related talks
49mConducting a Successful False Flag Cyber Operation (Blame it on China)
30mTales of Red Teaming
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
52mStart covering your bases & Stop chasing APT headlines
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
39mReal-World Detection Evasion Techniques in the Cloud
49mStories from the trenches - How a red team exercise gained full control of a client network
41mWhen Cybersecurity Is More Than Just Vulnerabilities