350. Threat Actors Leveraged the Discord API as Their C2 Channel
Hello everyone! In some cases adversaries do not need a dedicated C2 infrastructure. They can use the following technique: Web Service (T1102) . UNC5174 , for example, leveraged the Discord API as their C2 channel. This approach enabled the adversary to mimic legitimate traffic patterns and evade existing security policies. Unfortunately, Discord-related domains may be resolved by various legitimate software, but still it's a great target for hunting as it's not the first time threat actors abuse it: event_type: ("dnsreqwin" OR "dnsreqnix") AND dns_rname: ("discord.com" OR "discord.gg") AND NOT proc_file_path: *discord* See you tomorrow!