Do Son 
At a Glance
- Malware Family: Miraak
- Threat Actor: Unknown (Discovered via adversary operational security failure)
- Targets: Broad business operations and customer environments
- Delivery Vector: Trojanized .NET dependencies (hostfxr.dll, DocFX)
- Key Capabilities: PostgreSQL-backed C2, shell execution, screenshots, BOF execution, TCP pivoting
- Source: Blackpoint Adversary Pursuit Group (APG)
TL;DR
Blackpoint APG researchers uncovered the novel Miraak post exploitation framework. An adversary operational security failure exposed the toolkit on the open internet. This modular malware abandons traditional web beacons, using cloud-hosted PostgreSQL connections to mask its command-and-control traffic. Consequently, operators can execute commands, transfer files, and run Cobalt Strike modules while evading standard HTTP-based detection.
Delivery
Security researchers discovered the Miraak post exploitation framework by hunting for exposed infrastructure. Attackers accidentally left multiple framework components in attacker-controlled open web directories across ports 18081, 18082, and 18083. This operational security failure provided analysts with direct visibility into the operator platform. Researchers achieved this visibility before investigating an active intrusion.
The attackers rely on trust as a primary execution primitive. Instead of introducing obviously malicious executables, the Miraak framework hides its logic behind legitimate-sounding software names. Developers disguised the primary payload loader as a standard .NET runtime component named hostfxr.dll. The malicious DLL maintains expected export functions to blend into normal system processes.
Within the loader, a specific routine decodes embedded configurations using a basic byte-wise XOR operation. The loader then unpacks the core payload and writes it to a temporary directory. It uses a Microsoft Edge-themed filename and launches the executable. To minimize its footprint, the loader deletes the temporary file shortly after execution begins.
Infection Chain
Once the Miraak post exploitation framework executes, it begins profiling the infected host. The agent gathers the username, hostname, operating system, system architecture, and local security metadata. Miraak functions as a modular post exploitation framework rather than a simple backdoor, and it establishes a persistent foothold designed to support extensive operator activity.
During the investigation, researchers also identified a related F# tunneling implant. The attackers launch this secondary tool through a trojanized Microsoft DocFX assembly. The managed dependency avoids traditional native DLL sideloading. It invokes the malicious payload directly from its module initializer.
After execution, the F# implant creates a persistent worker thread and connects to a remote controller over TCP. This connection establishes a reverse TCP tunnel. Consequently, operators can pivot through the compromised endpoint. They can reach sensitive internal services. Normally, these services remain otherwise inaccessible from the public internet.
Command-and-Control and Data-Exfiltration Behavior
The most distinctive characteristic of the Miraak framework is its control plane The malware completely ignores traditional HTTP or HTTPS web endpoints Instead, the framework connects directly to cloud-hosted PostgreSQL and Timescale databases “Rather than communicating through traditional web-based C2 endpoints, Miraak uses database connections to register infected systems, retrieve operator tasking, track jobs, and return results.”
This architecture turns database state into the command protocol. The agent polls a dedicated task table for the next unclaimed command. It marks the task as claimed and later inserts the results into a separate table. Therefore, the malicious network sessions look like normal, encrypted database traffic communicating with legitimate cloud providers.
The agent itself features a broad native capability set. Operators can manage files, capture desktop screenshots, enumerate processes, and control sleep intervals without loading secondary tools. Furthermore, the framework natively supports Cobalt Strike Beacon Object Files. This compatibility allows attackers to execute specialized post exploitation modules. They can do this while retaining the unique database-backed C2 channel.
Defense and Detection Guidance
Defending against the Miraak post exploitation framework requires organizations to look beyond typical web-based malware signatures. Because the C2 traffic mimics legitimate PostgreSQL database connections, network defenders must enforce strict egress policies. Security teams should actively monitor for unauthorized database connections originating from unexpected endpoints. Additionally, process-to-destination correlation becomes vital for identifying endpoints that should not communicate with external cloud databases.
Endpoint security tools must monitor for suspicious .NET runtime loading behavior. Analysts should watch for anomalous hostfxr.dll executions or unexpected module initializations involving DocFX assemblies. Threat hunters should track the distinct self-signed TLS certificates associated with this ecosystem. The reverse proxy infrastructure presented a certificate labeled miraak-socks, providing a valuable indicator for identifying related attacker infrastructure.
Ultimately, this discovery highlights the danger of rapidly assembled offensive tooling. While the developers made severe operational security errors, the resulting Miraak modular post exploitation framework remains highly capable. Security teams must adapt their detection strategies. They need to account for malware that disguises its operations within standard administrative protocols.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
