How to Identify & Disrupt C2s Using Graph Analysis | Cybersecurity Blog | Grey Noise
Summary: GreyNoise and Black Lotus Labs used graph algorithms on netflow data enriched with GreyNoise's 'Mirai Variant'-tagged IPs to map 23 suspected C2 IPs that communicated with several hundred tagged hosts, and some of those turned out to be Mozi, a peer-to-peer botnet with no central C2. Separately, GreyNoise extracted embedded C2 addresses from scanner request payloads and compiled 3,368 suspected C2 IPs, of which Black Lotus Labs identified 962 as previously known C2s or botnet peers, with 98% of those confirmed as Mozi.
Bottom line: Bots are estimated to generate 25% of all internet traffic, and GreyNoise tags around 30k IPs as Mirai or Mirai Variant on any given day - so the C2 addresses behind that noise point directly at the vulnerabilities being exploited, such as the three CVEs tied to more than half the traffic for one Mozi C2 domain.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026