C2Centipede: APT-Level C2 Communications for Common Red Teams
Jose Garduno introduces C2Centipede, an advanced C2 communication framework implementing Fast Flux, Domain Generation Algorithms (DGA), and resilient relays.
Summary
The Network Resilience Gap in Threat Emulation
While nation-state threat actors employ sophisticated network resilience techniques, most open-source red team C2 tools rely on static domains and single-point HTTP egress.
Architecture of C2Centipede
Jose Garduno introduces C2Centipede, a modular communication framework implementing advanced network tradecraft—including Fast Flux networks, DGAs, and multi-protocol channels.
Resilient Multi-Hop Proxy Relays and Evasion
By dynamically rotating egress nodes and routing beacon traffic through decentralized relays, C2Centipede maintains persistent C2 connectivity across hostile blue team defenses.
Hunting Advanced C2 Channels
Garduno provides defenders with statistical traffic analysis metrics and behavioral heuristics to detect decentralized, algorithmically generated C2 traffic.
Related talks
Adversary Village·47 min
Daniel Duggan
Daniel Duggan (Rasta Mouse) shares architectural lessons and design patterns for engineering resilient, stealthy Command & Control (C2) frameworks.
Red Team Village·38 min
An introduction and technical overview of CyberWraith, the Red Team Village's open-source command-and-control and engagement infrastructure platform.
Demo Labs·20 min
Starkiller
A walkthrough of Starkiller, a graphical user interface frontend for managing PowerShell Empire post-exploitation agents and operations.