Brute Ratel C&C HTTP Connection

Brute Ratel is a post-exploitation framework that is available for legitimate pen testing. However, a leaked version of the tool has been adopted by attackers for malicious activity. The Brute Ratel framework enables an attacker to disguise command-and-control (C&C) communications as legitimate traffic from a Brute Ratel agent, called a badger, installed on the victim device.

After the badger is installed, the victim sends periodic HTTP POST beacon messages to the C&C server. When the attacker is ready to provide instructions, the C&C server responds to the victim request. HTTP responses from the C&C server include tasks such as "sleep" or "run command". After executing the tasks sent by the server, the victim sends an HTTP POST request that includes encrypted information such as metadata or command output. The Brute Ratel framework offers extensive features for generating shellcode, which makes the framework extremely efficient at bypassing firewalls and intrusion detection and prevention systems.