Aeternum: a modular C2 framework built for long-term access

QRator Labs has published an analysis of Aeternum, a modular command-and-control framework used by threat actors to manage compromised systems. The framework has an extensible architecture with support for plugins and remote modules, letting operators tailor capabilities for reconnaissance, data exfiltration and lateral movement. According to the research, Aeternum uses encrypted communications, flexible task execution and persistent implants to maintain long-term access. Its modular design lets operators change functionality on the fly and blend malicious traffic more closely with normal network activity.

What this means for your organisation

Frameworks like this are built to be discovered late or not at all. The consequence for an organisation is not a dramatic outage, but an attacker sitting quietly in the environment for months, taking what has value. That is the most expensive kind of incident to handle afterwards, because the scope is hard to establish and notification obligations arrive at the point where you can no longer say with confidence what was taken.

Berigo recommends

• Make sure endpoint, identity and network logs are retained long enough to reconstruct a timeline spanning several months.
• Monitor outbound traffic against what is normal for your environment, not just against known indicators.
• Segment the network so a single compromised endpoint does not open a path to the whole estate.
• Agree in advance who performs technical investigation on suspicion of long-term access, and what that supplier agreement covers.

Source

• qrator.net