CCDS C2: Infrastructure and Payload Analysis

The recovered artifacts show that 161.97.113.228 was used to operate and test a custom remote-control framework referred to as CCDS. The framework supports remote Linux shell-command execution, agent management, system-information collection, and bidirectional file transfer. Runtime logs confirm successful agent registration, command execution, and file transfers with size and hash verification. Two communication methods were identified. One implementation used a publicly accessible TLS listener on TCP port 4444 together with a locally bound management interface. This allowed operator commands to be submitted locally and forwarded to connected agents. Other agents communicated with HTTP or HTTPS controllers by periodically requesting tasks and returning results. The observed agent names included kali-1, test-agent-1, and smoketest.

The controller was configured as an enabled system service under the name ccds-c2.service, allowing it to remain active after service or host restarts. Authentication relied on a shared REVSHELL_TOKEN. A complete copy of this token was found in archived session data, meaning that access to those records could potentially expose the authentication material used by the framework. The activity recorded in the logs included operating-system and user discovery, hostname collection, external IP-address checks, outbound-connectivity testing, and remote file operations. The controller uploaded several files to /tmp and retrieved files such as /etc/hostname from an agent. Most of the observed filenames and contents were associated with transfer testing and validation. No destructive commands or attempts to disable security controls were identified in the reviewed controller logs.

The same environment contained several Go packages capable of automatically starting a Bash reverse shell or transmitting system information to a listener on TCP port 9999. Another package attempted to read and send the contents of /flag.txt. Some of this code was designed to execute automatically when a package was imported or loaded, which could create a security risk if the packages were included in another project or build process. A lightweight callback listener capable of receiving and recording the transmitted data was also recovered.

The evidence confirms a functional remote-control and offensive-security testing environment containing weaponized proof-of-concept packages. However, it does not independently establish deployment against unauthorized third-party systems.