Brute Ratel C&C TLS Connection

Brute Ratel is a post-exploitation framework that is available for legitimate pen testing. However, a leaked version of the tool has been adopted by attackers for malicious activity. The Brute Ratel framework enables an attacker to disguise command-and-control (C&C) communications as legitimate traffic from a Brute Ratel agent, called a badger, installed on the victim device. When a badger initiates a TLS session with the Brute Ratel team server, the C&C server presents a self-signed certificate spoofing Microsoft Security.

After a TLS connection is established, the victim exchanges HTTP POST requests and responses with the C&C server, which appears to be a legitimate domain. HTTP responses from the C&C server include tasks such as "sleep" or "run command". After executing the tasks sent by the server, the victim sends an HTTP POST request that includes encrypted information such as metadata or command output. The Brute Ratel framework offers extensive features for generating shellcode, which makes the framework extremely efficient at bypassing firewalls and intrusion detection and prevention systems.