pre.empt started a blog series that builds Maelstrom, a deliberately half-finished proof-of-concept C2, to work out what a minimum viable C2 needs against 2022-era endpoint protection and how defenders catch it. The architecture post covers language, compiler and crypto choices, and why RAII matters when every leaked object is an IoC.
Update 2022-07-11: The team server post weighs CLI, browser and desktop clients, settles on Flask with a Prompt Toolkit CLI over plain HTTP, then shows how one lazy custom X-Maelstrom header lets a single Snort rule catch the lot.
The implant post walks through environmental keying, anti-sandbox and anti-debug checks in stage 0 and reflective DLL loading and sleeping in stage 1, and the series ships YARA rules and VirusTotal samples for defenders.
Bonus points for admitting that “FUD” mostly means nobody has seen it yet.
Unit 42’s analysis of a Brute Ratel C4 sample had just shown what that looks like in the wild: the ISO-packaged red-team payload got a benign verdict from all 56 VirusTotal vendors that scanned it, wrapped in packaging that resembles APT29 tradecraft.