STILLEPOST- OR HOW TO PROXY YOUR C2'S HTTP TRAFFIC THROUGH CHROMIUM

Summary from the TLDR InfoSec newsletter

Chrome DevTools Protocol (CDP) allows tools to inspect, debug, instrument, and profile Chrome and other Chromium browsers. CDP provides a tempting target for C2 communication because the traffic can blend in with existing traffic and because browsers are usually already configured with appropriate proxy and firewall information. This post demonstrates a C2 implant that uses CDP to run in a headless browser and communicate with the C2 server via XHR requests driven by CDP JavaScript.