Miraak Framework Turns PostgreSQL Into a Covert C2 Channel
Malicious tools strive to blend into ordinary network traffic, but the new Miraak framework has gone further and transformed a cloud PostgreSQL database into a full-fledged channel for controlling infected computers. Blackpoint Cyber specialists uncovered the previously unknown toolset after the attackers themselves slipped up and left part of their infrastructure exposed on the internet.
A Full Post-Exploitation Arsenal
Miraak is designed to operate after an initial breach of a system, and it furnishes the operator with a broad array of capabilities. The framework executes commands, gathers details about the computer and the user, manages processes, captures screenshots, uploads and downloads files, adjusts the intervals of communication with the server, and runs lengthy tasks in the background.
PostgreSQL as Command Infrastructure
Miraak’s chief distinction lies in its command infrastructure. Rather than the customary HTTP requests, the agent connects directly to PostgreSQL and uses the database tables as a command queue. Through records in the database, the infected computer registers itself, receives new assignments, and returns results. To connect, the agent uses the standard libpq library, and in the configuration examined, the server resided within Tiger Data cloud infrastructure with mandatory SSL encryption.
Why Detection Grows Harder
Because of this scheme, detecting the server by the traditional hallmarks of command servers becomes more difficult. The network exchange may look like an ordinary encrypted connection to a cloud PostgreSQL instance. Consequently, defensive systems must weigh not only the destination address, but also the process that established the connection, the DNS queries, and any atypical outbound connections.
Masquerading as .NET Files
To launch Miraak, the attackers disguise the malicious components as familiar .NET environment files. Several samples bore the name hostfxr.dll, which in a normal installation belongs to the .NET startup library. The larger versions of this DLL decrypt the embedded agent, save it to the Windows temporary folder under the name msedgeupdate.exe, launch it, and soon delete the file. A more compact variant reads its settings from miraak.conf and runs the executable specified in that configuration.
Support for Cobalt Strike BOFs
The framework also supports BOFs, the small Beacon Object File modules from the Cobalt Strike ecosystem. The Miraak developers reproduced the necessary Beacon interfaces, so the operator can run existing BOF modules directly inside the agent without deploying a separate Beacon.
A Companion Tunnelling Tool
While the specialists were analysing Miraak, they discovered an associated tool for reverse TCP tunnelling. The F# component turns an infected computer into an intermediary node and allows other internal services to be reached through it. A shared infrastructure and a self-signed TLS certificate bearing the name miraak-socks confirm the link to Miraak, although Blackpoint Cyber regards the tunnel as a separate, related component rather than a built-in module of the framework.
Operator Blunders Exposed the Toolset
Miraak could be studied in such detail chiefly because of its operators’ mistakes. Loaders, agents, and auxiliary files ended up in open directories, while a flaw in the control panel made part of the interface visible even before the authorization check had completed.
No Attribution Yet
Blackpoint Cyber does not tie Miraak to any particular group and discloses no details about the affected organizations. Nevertheless, the feature set shows that the framework was built as a full-fledged platform for prolonged control over compromised networks.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
