2025 Year in Review: Malicious Infrastructure

Key Takeaways

• Infostealers remain the primary infection vector, with Vidar outperforming competitors and Lumma remaining resilient despite law enforcement pressure.
• Cobalt Strike retains dominance in Offensive Security Tool (OST) detections (~50%), though emerging tools like RedGuard, Ligolo, and Supershell are expanding notably.
• The malware ecosystem is anchored in MaaS and open-source tooling, with AsyncRAT and Quasar RAT leading the desktop RAT landscape, while Android dominates mobile activity.
• High loader turnover was observed following Operation Endgame, driven by Latrodectus, MintsLoader, and GrayBravo's CastleLoader.
• Threat Activity Enablers (TAEs) like Virtualine Technologies sustain operations through Regional Internet Registry (RIR) resource abuse and rapid rebranding despite sanctions.

Affected Systems

• Windows
• Android

Attack Chain

Threat actors leverage Malware-as-a-Service (MaaS) offerings, primarily infostealers, as initial infection vectors. Traffic Distribution Systems (TDS) are frequently used to route victims to malicious payloads. Once initial access is achieved, actors deploy loaders like CastleLoader or Latrodectus to drop secondary payloads. Post-exploitation and command-and-control are maintained using Offensive Security Tools (OSTs) like Cobalt Strike or various RATs, often obfuscated through legitimate CDNs like Cloudflare or hosted on resilient Threat Activity Enabler (TAE) networks.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article recommends deploying YARA, Sigma, and Snort rules to detect prevalent malware families, but does not provide specific rule bodies or queries within the text.

Detection Engineering Assessment

EDR Visibility: High — EDR solutions are highly effective at detecting the execution and in-memory presence of known OSTs (Cobalt Strike), RATs, and loaders mentioned in the report. Network Visibility: High — The report heavily emphasizes network infrastructure tracking, C2 detection, and TDS activity, which are highly visible at the network layer if proper decryption and flow logging are in place. Detection Difficulty: Moderate — While standard tools like Cobalt Strike have known signatures, actors increasingly use CDNs, legitimate services, and emerging tools (RedGuard, Ligolo) to evade traditional network detection.

Required Log Sources

• DNS query logs
• Network flow logs
• Proxy/Web filter logs
• Process creation logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Threat actors are utilizing emerging OSTs like RedGuard, Ligolo, and Supershell for C2 communication, bypassing traditional Cobalt Strike detections.	Network flow logs, EDR network connections	Command and Control	Low
Traffic Distribution Systems (TDS) are routing users to malicious infrastructure via compromised or actor-controlled domains.	Proxy/Web filter logs, DNS query logs	Initial Access	Medium

Control Gaps

• Legitimate Infrastructure Services (LIS) abuse (e.g., Cloudflare)
• Threat Activity Enabler (TAE) resilience despite sanctions

Key Behavioral Indicators

• Connections to known high-risk ASNs/networks (e.g., Virtualine Technologies, aurologic GmbH)
• Use of default or widely known malleable C2 profiles (e.g., jQuery)

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Prioritize detection and mitigation of prevalent malware families like Cobalt Strike, AsyncRAT, and Vidar.
• Review and update network blocklists for known Threat Activity Enabler (TAE) networks.

Infrastructure Hardening

• Enhance network monitoring capabilities to detect C2 and TDS activity.
• Carefully balance blocking, flagging, or allowing high-risk Legitimate Infrastructure Services (LIS) based on assessed criticality and organizational risk tolerance.

User Protection

• Deploy robust endpoint protection to detect infostealers, loaders, and RATs.
• Implement mobile device management (MDM) and security controls to mitigate Android-based malware threats.

Security Awareness

• Conduct threat simulations to validate defensive posture against prevalent OSTs and malware.
• Maintain continuous monitoring of the broader threat landscape and evolving infrastructure dynamics.

MITRE ATT&CK Mapping

• T1003 - OS Credential Dumping
• T1071 - Application Layer Protocol
• T1105 - Ingress Tool Transfer
• T1583 - Acquire Infrastructure
• T1584 - Compromise Infrastructure

Additional IOCs

• Other:
  • Virtualine Technologies - High-risk network / Threat Activity Enabler (TAE) sustaining operations through RIR resource abuse.
  • aurologic GmbH - Network frequently used for transit by high-risk TAEs like Virtualine Technologies.