{"id":49155,"date":"2022-11-03T16:00:00","date_gmt":"2022-11-03T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=124506"},"modified":"2022-11-03T16:00:00","modified_gmt":"2022-11-03T16:00:00","slug":"stopping-c2-communications-in-human-operated-ransomware-through-network-protection","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/","title":{"rendered":"Stopping C2 communications in human-operated ransomware through network protection"},"content":{"rendered":"<p>Command-and-control (C2) servers are an essential part of ransomware, commodity, and nation-state attacks. They are used to control infected devices and perform malicious activities like downloading and launching payloads, controlling botnets, or commanding post-exploitation penetration frameworks to breach an organization as part of a ransomware attack. Blocking these communications can mitigate attacks, sometimes before they\u2019re even started.<\/p>\n<p>For example, one of the most impactful cyberattack trends today is <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2020\/03\/05\/human-operated-ransomware-attacks-a-preventable-disaster\/\">human-operated ransomware<\/a> attacks, which succeed through a combination of components, including leveraging C2 infrastructure. To gain initial access, human-operated ransomware attacks are often delivered via spear-phishing with malicious attachments that, once launched by the target, typically reach out to a C2 server to download instructions and run payloads. These payloads persist on the device and periodically reach out to a (usually) separate set of C2s, awaiting instructions and takeover by a human operator as part of <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/05\/09\/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself\/\">ransomware-as-a-service<\/a>. After the hands-on-keyboard transition, remote C2s are commonly used to control post-exploitation frameworks to initiate reconnaissance, elevate privileges, and move laterally within the network to achieve data exfiltration and mass file encryption.<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"393\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-1024x393.png\" alt=\"A human-operated ransomware attack example highlighting C2 usage. The attacker begins with the initial access stage, followed by execution, the initial C2 connection, persistence, a beaconing C2 connection, a post-exploitation C2 connection that continues throughout the attack, leading to lateral movement, and the final impact stage.\" class=\"wp-image-124508\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-1024x393.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-300x115.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-768x295.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-1536x590.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-2048x787.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><figcaption>Figure 1. Example of C2 usage across the stages of a human-operated ransomware attack<\/figcaption><\/figure>\n<p>Ransomware has evolved from a pre-programmed commodity threat to a complex threat that\u2019s human-driven, adaptive, and focused on a larger scale. These days, ransomware attacks go beyond encryption and usually involve significant data theft as well to maximize the potential harm to the target, therefore increasing their chances of receiving a higher payout. Attackers engage in double extortion, demanding victims either pay the ransom or stolen confidential information is leaked and encrypted data remains inaccessible. As such, successful ransomware attacks can have lasting, damaging impacts on targets.<\/p>\n<p>As ransomware attacks continue to target various entities, including businesses, governments, <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/10\/14\/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland\/\">critical infrastructure<\/a>, <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/10\/25\/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector\/\">educational institutions<\/a>, and <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2020\/04\/28\/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk\/\">healthcare<\/a> facilities, organizations much be prepared to defend networks against human-operated attacks and other sophisticated threats. Microsoft Defender for Endpoint\u2019s updated network protection enables organizations to protect against these C2-based attacks by blocking any outbound traffic attempting to connect to malicious C2 servers, even if attackers manage to gain initial access to a device. Additionally, network protection is continuously informed by our integrated threat intelligence to identify active C2 infrastructure and uses machine learning models to quickly assess information on domains and IPs.<\/p>\n<p>This blog details how the new <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/microsoft-defender-for-endpoint\/detecting-and-remediating-command-and-control-attacks-at-the\/ba-p\/3650607\">C2 blocking capability<\/a> in Microsoft Defender for Endpoint\u2019s network protection works. We show examples of how network protection functions with other technologies in Microsoft Defender for Endpoint to deliver comprehensive protection against C2-based attacks. Lastly, we discuss how our threat research and use of advanced machine learning models inform network protection to intelligently block ransomware and C2-based attacks before widespread impact.<\/p>\n<h2>Network protection detecting C2 activity in various attacks<\/h2>\n<p>The following cases of human-operated ransomware attacks from our threat data and investigations show how the new C2 blocking capability in network protection stop attacks and, in some cases, could have prevented attacks much earlier.<\/p>\n<h3>Disrupting the ransomware attack chain<\/h3>\n<p>In early October 2022, we observed an attack leveraging the <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/10\/27\/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity\/\">Raspberry Robin worm<\/a> as the initial access vector. Upon launch by the user, the attack attempted to connect to the domain <em>tddshht[.]com <\/em>via HTTP using <em>msiexec.exe<\/em> to download a TrueBot payload. As part of these attacks, TrueBot is typically downloaded to a user\u2019s local application data directory where Windows Management Instrumentation (WMI) is used to run the TrueBot DLL using <em>rundll32<\/em>. In this case, network protection was enabled in the environment and blocked the C2 communication from <em>msiexec.exe<\/em> to <em>tddshht[.]com<\/em>, which prevented TrueBot from being downloaded and launched, disrupting the attack.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/10\/27\/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity\/\">In similar attacks<\/a> on organizations originating from Raspberry Robin, we\u2019ve seen TrueBot lead to Cobalt Strike for post-exploitation human-operated ransomware attacks. After launching TrueBot, we observed various follow-on actions, such as reconnaissance, persistence via scheduled tasks, and ransomware deployment.<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"259\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-1024x259.png\" alt=\"Raspberry Robin malware launches the Windows Installer service and msiexec.exe sends C2 communications of HTTP, which is blocked by network protection, preventing the attack from progressing. The attack was disrupted before the C2 connected to the domain tddshht[.]com, when TrueBot would be downloaded and launched, followed by dropping a Cobalt Strike beacon that transfers to hands-on-keyboard attack and a Cobalt Strike C2 connection, leading to follow-on activities and ransomware deployment.\" class=\"wp-image-124509\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-1024x259.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-300x76.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-768x194.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-1536x389.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-2048x518.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><figcaption>Figure 2. Raspberry Robin incident disrupted by network protection &nbsp;<\/figcaption><\/figure>\n<h3>Stopping ransomware activity before it could wreak havoc<\/h3>\n<p>In another ransomware-related case from March 2022, Microsoft researchers discovered a LockBit ransomware attack that was successfully detected and blocked. LockBit is an encryptor payload leveraged by many different operators who specialize in the post-exploitation phase of the attack as part ransomware as a service. In this case, there were multiple security products in different segments of the environment, and we didn\u2019t have visibility of the initial access vector. As the attackers moved laterally within the network, we observed the operator using the Cobalt Strike framework for the post-exploitation stages of the attack, using Remote Desktop Protocol (RDP) with Rclone for data exfiltration, and LockBit at the final encryption stage. The encryption attempt followed the exfiltration stage by just two hours.<\/p>\n<p>Throughout the attack, Microsoft Defender for Endpoint proactively displayed repeated alerts for the targeted customer that an active hands-on-keyboard attacker was active on their network, as well as repeated Cobalt Strike activity alerts and suspicious behaviors. <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender-endpoint\/microsoft-defender-antivirus-windows?view=o365-worldwide\">Microsoft Defender Antivirus\u2019s<\/a> behavior detections repeatedly alerted and blocked Cobalt Strike in addition to fully blocking the attack\u2019s LockBit encryptor payload, preventing impact on the subset of the network that had onboarded to Microsoft Defender for Endpoint.<\/p>\n<p>Prior to this attack, network protection had already flagged the Cobalt Strike C2 domain <em>sikescomposites[.]com<\/em> as malicious. Had network protection C2 protection been enabled across the organization, then the Cobalt Strike C2 server would have been automatically blocked \u2013 further disrupting this attack earlier in the attack chain and potentially preventing or delaying the data exfiltration impact of the attack.<\/p>\n<p>The network protection intelligence on the C2 was sourced two weeks before the attack in February 2022 through expert intelligence from Microsoft Threat Intelligence Center (MSTIC) and also incriminated via Cobalt Strike configuration extraction monitoring. Microsoft Defender for Endpoint could have disrupted this LockBit attack much earlier had network protection been enabled. Moreover, even if the attacker used a different or new payload, network protection would have blocked the attack if it used the same C2 infrastructure. The diagram below illustrates the timeline of events in this ransomware incident.<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"349\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-1024x349.png\" alt=\"Two weeks before the attack, Microsoft's threat intelligence research sent intelligence on the C2 domain to network protection. Between Days 1 and 3, the attacker started hands-on-keyboard activity, repeated alerts displayed in Defender for Endpoint and the domain C2 connection was repeatedly observed and flagged by network protection. On Day 4, the attacker performed data exfiltration, Microsoft Defender Antivirus blocked the attacker's encryption payload, and the attacker successfully encrypted one device after restoring LockBit from quarantine.\" class=\"wp-image-124510\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-1024x349.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-300x102.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-768x262.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-1536x524.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-2048x699.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><figcaption>Figure 3. LockBit ransomware incident timeline<\/figcaption><\/figure>\n<h2>End-to-end protection against C2-based attacks<\/h2>\n<p>The range of protection capabilities in <a href=\"https:\/\/www.microsoft.com\/security\/business\/endpoint-security\/microsoft-defender-endpoint\">Microsoft Defender for Endpoint<\/a> ensure our customers are provided with synchronous protection, integrated remediation, and actionable alerts against these C2-based attacks. The combination of technologies and features within Defender for Endpoint assures customers that their assets are adequately protected.<\/p>\n<p><a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender-endpoint\/network-protection?view=o365-worldwide\">Network protection<\/a> blocks any outbound traffic when an application attempts to connect to known malicious C2 and informs customers of the block.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"999\" height=\"214\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-4.-Sample-C2-activity-alert.png\" alt=\"The Microsoft 365 Defender portal's alerts page displaying two examples of blocked C2 activity via network protection.\" class=\"wp-image-124511\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-4.-Sample-C2-activity-alert.png 999w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-4.-Sample-C2-activity-alert-300x64.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-4.-Sample-C2-activity-alert-768x165.png 768w\" sizes=\"auto, (max-width: 999px) 100vw, 999px\"><figcaption>Figure 4. Example of blocked C2 activity in the Microsoft 365 Defender portal<\/figcaption><\/figure>\n<p>Network protection then sends this intelligence to <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender-endpoint\/microsoft-defender-antivirus-windows?view=o365-worldwide\">Microsoft Defender Antivirus<\/a>, which remediates the process against known malware that attempted the C2 connection. Customers are then notified of these actions on the Defender for Endpoint portal, where they can see the attack chain, follow remediation steps, or do further investigation.<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"484\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-1024x484.png\" alt=\"Diagram displaying how network protection blocks C2 connections using reputation lookup, sending connection metadata to signature matching to remediate the process via Microsoft Defender Antivirus, ultimately allowing Microsoft Defender for Endpoint to generate alerts using its detection logic.\" class=\"wp-image-124512\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-1024x484.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-300x142.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-768x363.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-1536x727.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-2048x969.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><figcaption>Figure 5. Alerts for investigation in the Microsoft Defender for Endpoint portal are generated through a combination of technologies to protect against C2-based attacks<\/figcaption><\/figure>\n<p>Network protection uses a dynamic reputation database that stores information on IPs, domains, and URLs gathered from a wide range of sources including threat research, detonation, adversary tracking, memory scanning, and active C2 web scanning. These activities lead to identifying C2 servers operated by human-operated ransomware actors and botnet actors and discovering compromised IPs and domains associated with known nation-state actors.<\/p>\n<p>Network protection is aided by machine learning models that incriminate IP addresses used for C2 by inspecting network traffic telemetry. These models are trained on an extensive data set and use a diverse feature set, including DNS records, prevalence, location, and associations with compromised files or domains. Our threat experts\u2019 knowledge further helps refine these models, which are re-trained and redeployed daily to adapt to the ever-changing threat landscape.<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"411\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-1024x411.png\" alt=\"Training data, including good and malicious C2 IP addresses, is used to train machine learning models in addition to using extracted feature sets to predict new C2 IPs. This information is sent to Microsoft Defender for Endpoint to block malicious connections, perform remediation, and generate alerts.\" class=\"wp-image-124513\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-1024x411.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-300x120.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-768x308.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-1536x617.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-2048x822.png 2048w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-900x360.png 900w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><figcaption>Figure 6. Machine learning pipeline to generate new intelligence to protect customers from C2-based attacks<\/figcaption><\/figure>\n<h2>Preventing C2-based attacks<\/h2>\n<p>Attackers often rely heavily on leveraging C2 communications to start and progress attacks, including human-operated ransomware attacks. C2 infrastructure enables attackers to control infected devices, perform malicious activities, and quickly adapt to their target environment in the pursuit of organizations\u2019 valuable data and assets.<\/p>\n<p>Breaking this link to C2 infrastructure disrupts attacks\u2014either by stopping it completely or delaying its progression, allowing more time for the SOC to investigate and mitigate the intrusion. Microsoft Defender for Endpoint\u2019s <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender-endpoint\/network-protection?view=o365-worldwide\">network protection<\/a> capability identifies and blocks connections to C2 infrastructure used in human-operated ransomware attacks, leveraging techniques like machine learning and intelligent indicators of compromise (IOC) identification.<\/p>\n<p>Microsoft customers can use the new C2 blocking capability to prevent malicious C2 IP and domain access by enabling network protection. Network protection examines network metadata to match them to threat-related patterns and determines the true nature of C2 connections. Enhanced by continuously fine-tuned machine learning models and constant threat intelligence updates, Microsoft Defender for Endpoint can take appropriate actions to block malicious C2 connections and stop malware from launching or propagating. Customers can also refer to our <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/microsoft-defender-for-endpoint\/detecting-and-remediating-command-and-control-attacks-at-the\/ba-p\/3650607\">Tech community blog post<\/a> for guidance on validating functionality and more information on C2 detection and remediation.<\/p>\n<p>In addition to <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender-endpoint\/enable-network-protection?view=o365-worldwide\">enabling network protection<\/a> C2 blocking, it\u2019s recommended to follow the <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/05\/09\/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself\/#defending-against-ransomware\">general best practices to defend your network against human-operated ransomware attacks<\/a>.<\/p>\n<p> READ MORE <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/11\/03\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Providing advanced protection against increasingly sophisticated human-operated ransomware, Microsoft Defender for Endpoint\u2019s network protection leverages threat intelligence and machine learning to block command-and-control (C2) communications.<br \/>\nThe post Stopping C2 communications in human-operated ransomware through network protection appeared first on Microsoft Security Blog. READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":49156,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[276],"tags":[1496,1497,347,8549,230,7221,10267,91,307],"class_list":["post-49155","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-secure","tag-c2","tag-command-and-control","tag-cybersecurity","tag-human-operated-ransomware","tag-microsoft","tag-microsoft-security-intelligence","tag-network-protection","tag-ransomware","tag-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Stopping C2 communications in human-operated ransomware through network protection 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Stopping C2 communications in human-operated ransomware through network protection 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-03T16:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-1024x393.png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Stopping C2 communications in human-operated ransomware through network protection\",\"datePublished\":\"2022-11-03T16:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\"},\"wordCount\":1555,\"publisher\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png\",\"keywords\":[\"C2\",\"command and control\",\"Cybersecurity\",\"human-operated ransomware\",\"Microsoft\",\"Microsoft security intelligence\",\"Network protection\",\"ransomware\",\"Security\"],\"articleSection\":[\"Microsoft Secure\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\",\"url\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\",\"name\":\"Stopping C2 communications in human-operated ransomware through network protection 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png\",\"datePublished\":\"2022-11-03T16:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage\",\"url\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png\",\"contentUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png\",\"width\":1024,\"height\":393},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.threatshub.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"C2\",\"item\":\"https:\/\/www.threatshub.org\/blog\/tag\/c2\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Stopping C2 communications in human-operated ransomware through network protection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#website\",\"url\":\"https:\/\/www.threatshub.org\/blog\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\/\/www.threatshub.org\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Stopping C2 communications in human-operated ransomware through network protection 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/","og_locale":"en_US","og_type":"article","og_title":"Stopping C2 communications in human-operated ransomware through network protection 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-11-03T16:00:00+00:00","og_image":[{"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-1024x393.png","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Stopping C2 communications in human-operated ransomware through network protection","datePublished":"2022-11-03T16:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/"},"wordCount":1555,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png","keywords":["C2","command and control","Cybersecurity","human-operated ransomware","Microsoft","Microsoft security intelligence","Network protection","ransomware","Security"],"articleSection":["Microsoft Secure"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/","url":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/","name":"Stopping C2 communications in human-operated ransomware through network protection 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png","datePublished":"2022-11-03T16:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/11\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection.png","width":1024,"height":393},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/stopping-c2-communications-in-human-operated-ransomware-through-network-protection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"C2","item":"https:\/\/www.threatshub.org\/blog\/tag\/c2\/"},{"@type":"ListItem","position":3,"name":"Stopping C2 communications in human-operated ransomware through network protection"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/49155","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=49155"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/49155\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/49156"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=49155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=49155"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=49155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}