Writing a Bug Sleep C2 server and detecting its traffic with Snort
Summary: Cisco Talos analyzed the BugSleep (MuddyRot) RAT, which uses a bespoke C2 protocol over plain TCP sockets on port 443, encrypts payloads by subtracting a static value of three from each byte, and beacons a ComputerName/Username string to its server. Talos reversed the protocol, built a functional C2 server to emulate operator conversations, and published Snort SIDs 63937 and 63938 to detect the beacon and command traffic.
What you should know: The implant beacons on port 443, so any TCP traffic leaving your network on that port with the encoded length bytes at offset one will alert - and Talos notes the false-positive rate on that rule still isn't great, meaning your detection depends on chaining flowbits across the beacon and the command that follows.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026