MYTHIC C2 WITH EARLYBIRD INJECTION AND DEFENDER EVASION

Summary from the TLDR InfoSec newsletter

This post walks through a demo setup of the Mythic C2 framework that uses redirectors to disguise itself as legitimate WordPress traffic. The redirectors use a legitimately registered domain and certificates and use Nginx to offer WordPress as a front end, as well as an api subdomain that forwards traffic to the C2 server and a dl subdomain that disguises payloads as font files. The setup also utilizes the EarlyBird Injection technique, where the loader executes code before the target process is fully initialized, both in its loader and through string obfuscation to employ evasion during installation. The post concludes with a discussion of further enhancements, such as ensuring domain age before weaponizing it and detection mechanisms for this setup.