DEF CON 34 - Main - C2YA Inside the Adversary's Inbox - Vitaly Simonovich

Security researcher Vitali Simanovich used LLM coding agents (Claude Code, Codex, Gemini) to find 250 flaws across five open-source C2 frameworks, letting defenders fingerprint servers, decrypt traffic, and disrupt operations 4:39.

Key Takeaways:
• Frameworks studied (Havoc, Mythic, Silver, Covenant, Adaptic) are open source and actively used by APT and ransomware groups 3:24
• Findings used defender-weighted severity scoring instead of CVSS; 85 flaws need only a public IP to exploit 7:28
• Havoc's unauthenticated websocket broadcasts the AES key and IV in cleartext, enabling full traffic decryption without logging in 14:22
• Havoc's AES-CTR IV reuse enables Venona-style cryptanalysis, shown in a live demo 25:03
• Covenant allows low-privilege users to escalate to admin and achieve RCE via the Roslyn-compiled "message transform" field 19:48
• "Operation Poison": 33 days of passive observation of a real attack on four French victims via honeypot 34:55

The talk urges defenders to run vulnerability research on adversary tooling itself, while warning red teamers the flaws cut both ways and that taking down a C2 server alone isn't sufficient 45:50.

Sources:

• 4:39 250 flaws across five frameworks
• 7:28 Defender-weighted scoring
• 14:22 Havoc websocket key exposure
• 25:03 AES-CTR IV reuse cryptanalysis
• 19:48 Covenant escalation to RCE
• 34:55 Operation Poison eavesdropping
• 45:50 Closing lessons