New Video from @BlackHatOfficialYT: AI-Powered Image-Based C2 Framework

In this video, Wanda introduces speakers Chen Fang and Chris Nawarte, both security researchers at Palo Alto Networks, to discuss an AI-powered, image-based command and control framework. This framework uses AI models to conceal and extract commands within C2 images.

Chen Fang begins by explaining that image steganography is not new in the security field. Traditionally, attackers add their payloads to images using specific encoders and decoders, requiring deep knowledge of the image itself. However, deep image steganography uses neural networks to automatically learn how to encode and decode data, eliminating the need for specific image knowledge. The encoders and decoders in this case are AI models, which can bypass existing detection services that use binary analysis or code analysis.

The architecture of their AI model includes secret-to-tensor and image-to-tensor converters, as well as secret and image reconstruction laws to ensure training quality. Chen Fang then explains the steps of converting images and malicious payloads into tensors using standard libraries like PyTorch. He also details the encoding process, which involves concatenating secret tensors and image feature vectors to create a steganographic image. The decoder, on the other hand, uses convolutional layers to extract the decoded message.

Evaluation results show that training a generic model to hide arbitrary data is impractical, as it requires a lot of time without guaranteeing a high success rate. In contrast, training specific to particular data is much more efficient, achieving a 100% success rate in just a few seconds. This method is therefore more suitable for C2 attacks, as it ensures precise reconstruction of payloads and can be performed on the C2 server side.

Chris Nawarte then takes the stage to present the prototype of their C2 framework. He explains the C2 attack flow, which starts with training the model, followed by hosting the image artifacts and model. The C2 client then retrieves the model and necessary files to process the images and extract commands. Chris demonstrates how the C2 client uses the model to decode commands hidden in images and executes these commands, while encrypting the results for secure exfiltration.

The practical demonstration shows the C2 client in action, downloading the model, dependency files, and encryption key, then executing commands like "whoami" and "system info." Chris also shows how a more complex command, such as a PowerShell reverse shell, can be executed and how the data is then securely exfiltrated.

In conclusion, this video presents an innovative AI-powered, image-based command and control framework that can be used to conceal and execute malicious commands. The researchers emphasize the importance of understanding these techniques to better defend against such attacks. They also plan to improve their model and expand the supported operational commands to make the framework even more robust.

To learn more, watch the full video at the following address: https://www.youtube.com/watch?v=MoDYOm2fPJ0