Threat Profile & Target Surface
ORIGIN & THEATER
Unknown / European Infrastructure
Observed active infrastructure & staging OPERATIONAL STATUS
ACTIVE
First Seen: 2026-06 | Last: 2026-08 TARGETED SECTORS & VERTICALS
🎯 Enterprises with Strict Egress Controls & Next-Gen Firewalls🎯 Corporate Windows Workstations & Active Directory Networks
WEAPONRY & TOOLING ARSENAL
⚔️ Imikom Agent (payload_win_prod.c)⚔️ Mythic C2 Framework⚔️ GitHub API Dead-Drop Relay (github_c2.c)⚔️ Google Sheets API C2 Transport (deploy_google_sheets.c)⚔️ HWiNFO_x64_206.sys (BYOVD Vulnerable Driver)⚔️ TRIXX.sys (BYOVD Vulnerable Driver)⚔️ Process Hollowing Engine (hollow.c)
Intelligence Telemetry & Findings
Key Operational Findings
- Cloud Dead-Drop Egress Bypasses: Imikom replaces direct outbound connections with trusted CDN endpoints:
- GitHub Contents API (
github_c2.c): Relays commands via repositoryderwingoww/edge-nodes(nodes/{id}/outandnodes/{id}/in) using authenticated PAT tokens to defeat Next-Gen Firewall (FortiGate/Palo Alto) inspection. - Google Sheets API (
deploy_google_sheets.c): Bi-directional command exchange viasheets[.]googleapis[.]comover OAuth2.
- GitHub Contents API (
- Kernel EDR Blinding (BYOVD): Staging signed drivers
HWiNFO_x64_206.sysandTRIXX.systo execute ring-0 kernel writes that disablePspCreateProcessNotifyRoutinecallbacks. - Evasion & Masquerading: Obfuscated binaries disguise as
OfficeSupport.exeandWindowsTelemetry.exe, using in-memory process hollowing and XOR stack string decryption.
Technical Telemetry & Indicators
| Indicator Type | Defanged Value | Operational Role |
|---|---|---|
| IPv4 Address | 2[.]27[.]63[.]244 | Staging & Compilation Node (Fastweb, Italy) |
| Port / Service | 2[.]27[.]63[.]244:9999 | Exposed Tooling & Staging Repository |
| Domain | cdn-staticfiles[.]com | Default Fallback HTTPS C2 Domain |
| GitHub Relay | derwingoww/edge-nodes | Covert Dead-Drop Relay Repository |
| Driver (BYOVD) | HWiNFO_x64_206.sys | Vulnerable Signed Driver for Kernel Callback Unhooking |
| Driver (BYOVD) | TRIXX.sys | Vulnerable Signed Driver for Kernel EDR Blinding |
| Persistence | OfficeSupport | Scheduled Task (%APPDATA%\Microsoft\Office\OfficeSupport.exe) |
MITRE ATT&CK Framework Mapping
| Tactic / ID | Observed Adversary Technique & Context |
|---|---|
| T1102.001 | Web Service: Dead Drop Resolver (GitHub / Google Sheets API) |
| T1068 | Exploitation for Privilege Escalation (BYOVD Driver Exploitation) |
| T1055.012 | Process Hollowing |
| T1562.001 | Disable or Modify Tools (AMSI & EDR Driver Blinding) |
| T1027 | Obfuscated Files or Information (Stack String Encryption / obfstr.h) |
| T1053.005 | Scheduled Task (OfficeSupport Persistence) |
| T1036.005 | Masquerading: Match Legitimate Name (WindowsTelemetry.exe, OfficeSupport.exe) |
Chronological Operational Timeline
Staging Pipeline & Mythic Backend Setup
Host 2[.]27[.]63[.]244 operationalized with automated C compilation toolchain (Mingw-w64) and Mythic C2 backend database.
BYOVD Driver Weaponization
Integration of signed vulnerable hardware drivers (HWiNFO_x64_206.sys and TRIXX.sys) into payload builders for ring-0 kernel callback unhooking.
GitHub & Google Sheets Dead-Drop Relay Integration
Development of github_c2.c and deploy_google_sheets.c transports specifically engineered to bypass corporate FortiGate deep packet inspection.
Automated Build Pipeline Deployment
Active compilation of polymorphic loaders (Imikom v1-v10) masquerading as Microsoft Office Support and Windows Telemetry binaries.