Are there any detailed case-studies in which infected machines in a certain network or on the internet were communication with each other (I'm not interested in cases with only machine <-> C&C communications)?

E.g.: PC-A gets infected, then infects PC-B etc... PC-A and maybe others open a port and then the infected machines communicate with each other (and maybe with the C&C as well).


I don't know what you expect precisely when you ask for "detailed case-studies", but if PC-B has no Internet access, it is a well-known practice for the attacker to use PC-A as a relay between PC-B and the C&C:

PC-B <---> PC-A <---> C&C

To give a more concrete example:

  1. PC-A belongs to the users LAN, this is the computer where people access to their emails and browse the Web. Sadly, one email or web page was infected, thus contaminating PC-A.
  2. Once in running in the LAN, either in an autonomous way or remotely controlled by the C&C, the virus starts to scan the network and try to propagate itself. It reaches PC-B (unpatched vulnerability, poor password or whatever) and contaminates it.
  3. PC-B belongs to another, restricted network with no access to the Internet (with chances that it has access to more interesting resources!). The virus can setup a way for PC-B to use PC-A as a relay to get new orders from the C&C and exfiltrate data.

This relay can take any form depending on the attacker fantasy and requirements. It can range from simple proxy-like features to a full fledged peer-to-peer network ensuring that the virus' network will remain functional even if some relay machines are being decontaminated.

  • By detailed case-studies I mean papers/documents by security researchers that describe such techniques in the wild. – ENG Sep 4 '16 at 13:27
  • @ENG: You will find such techniques mostly in state sponsored espionage software as they are costly to design and implement. Two good examples may be Uroburos (see the intro and page 9 "Network capabilities", attributed to Russia) and Regin (see page 16 "Topology", attributed to US and/or UK). – WhiteWinterWolf Sep 4 '16 at 18:50
  • I would add this to the answer as those are good examples : ) – ENG Sep 5 '16 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.