Introducing C2 Detection: Know When Your Edge Devices Are Calling Home to Attackers
Summary: GreyNoise launched C2 Detection, an intelligence module that extracts callback destinations from exploit payloads sent to its global sensor network and collects the malware hosted there to map staging servers and command-and-control infrastructure. The output is a continuously updated dataset of confirmed callback IPs and associated malware hashes, with each callback IP classified into one of three stages based on what GreyNoise has confirmed.
Key Takeaway: Edge and perimeter devices - routers, firewalls, VPN concentrators - are the most actively exploited assets on the internet and the ones EDR does not run on, so a compromise shows up only as an outbound connection buried in firewall logs. GreyNoise is now selling that outbound signal as a detection rather than context, which puts the question to security leaders: who is watching what your edge devices call out to.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026