Pierluigi Paganini August 05, 2022

Dark Utilities “C2-as-a-Service” is attracting a growing number of customers searching for a command-and-control for their campaigns.

The popularity of the Dark Utilities “C2-as-a-Service” is rapidly increasing, over 3,000 users are already using it as command-and-control for their campaigns.

Dark Utilities was launched in early 2022, the platform that provides full-featured C2 capabilities to its users. Dark Utilities is advertised as a platform to enable remote access, command execution, conduct distributed denial-of-service (DDoS) attacks and cryptocurrency mining operations on infected systems.

It allows threat actors to target multiple architectures without requiring technical skills. The operators of the platform offer technical support and assistance to the customers through Discord and Telegram.

“Dark Utilities provides payloads consisting of code that is executed on victim systems, allowing them to be registered with the service and establish a command and control (C2) communications channel.” reads the analysis published by Cisco Talos researchers. “The platform currently supports Windows, Linux and Python-based payloads, allowing adversaries to target multiple architectures without requiring significant development resources.”

The platform is hosted on both clear internet and Tor network, its operators offers premium access to the platform, associated payloads and API endpoints for 9.99 euros. At the time of writing, the platform had enrolled roughly 3,000 users, which is approximately 30,000 euros in income.

The Dark Utilities platform uses Discord for user authentication, it implements a dashboard displaying platform statistics, server health status and other metrics.

Users can generate new payloads for specific operating systems and deploy them on the victim machines.

“Selecting an operating system causes the platform to generate a command string that threat actors are typically embedding into PowerShell or Bash scripts to facilitate the retrieval and execution of the payload on victim machines.” continues the report.

The researchers pointed out that payloads provided by the platform are hosted within the Interplanetary File System (IPFS), making them resilient to content moderation or law enforcement intervention.

IPFS is a distributed, peer-to-peer network, that prevent takeover from authorities. IPFS supports gateways, which operate similar to Tor2Web gateways, to allow users on the internet to access contents hosted within IPFS without requiring a client application to be installed.

Dark Utilities appears to have been designed by a threat actor that goes under the moniker Inplex-sys. 

Talos researchers believe Inplex-sys collaborated with one of the operators of a botnet service called Smart Bot, which is designed to launch spam attacks, or “raids” against the Discord and Twitch communication platforms.

“Although the Dark Utilities platform was recently established, thousands of users have already been enrolled and joined the platform. Given the amount of functionality that the platform provides and the relatively low cost of use, we expect this platform will continue to rapidly expand its user base.” concludes the report. “This will likely result in an increase in the volume of malware samples in the wild attempting to establish C2 using the platform.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, c2-as-a-service)

[adrotate banner=”5″]

[adrotate banner=”13″]