STRIKE identified CanOworms, a ~633-server commercial VPN/proxy network spanning a dozen+ countries, fingerprinted via a shared self-signed TLS certificate plus corroborating JARM/JA4X signatures — not one actor’s private C2 infrastructure.
Tenants are mostly commodity RAT operators (Remcos, Quasar, NanoCore, NetWire, AsyncRAT, Loki); partners FalconFeeds and Malanta also flagged suspected China-nexus and North Korean actors on the same infrastructure, but only at low confidence and as tenants among many, not owners.
The fleet functions as a disposable front, not true C2 — traffic passes through relays rather than originating there, which is why IP blocklists, geolocation, and ASN reputation all fail against it.
Live attack traffic (SSH credential-spray patterns against routers/cameras in commodity-crime geography) transits the network, though it’s unclear whether that’s the operator or tenants routing their own tools.
Business lineage traces back to 2017 under earlier shell brands (PrivacyFirst/MAXKO, AS214366); the operator remains unattributed by design — one investigative lead was traced and ruled out as an innocent third party.
For defenders: durable detection relies on build fingerprints (certificate thumbprints, JARM, JA4X) rather than IP/geo/ASN signals, since the network is engineered to churn and absorb takedowns.
Back to Virtual & Digital Events
October 8, 2026
3:00 PM - 4:30 PM
(ET)
3:00 PM
(ET)
Opening Remarks & Executive Introductions
