Imikom Ghost: Cloud Dead-Drop & Mythic C2 Operation

Key Operational Findings

• Cloud Dead-Drop Egress Bypasses: Imikom replaces direct outbound connections with trusted CDN endpoints:
  • GitHub Contents API (github_c2.c): Relays commands via repository derwingoww/edge-nodes (nodes/{id}/out and nodes/{id}/in) using authenticated PAT tokens to defeat Next-Gen Firewall (FortiGate/Palo Alto) inspection.
  • Google Sheets API (deploy_google_sheets.c): Bi-directional command exchange via sheets[.]googleapis[.]com over OAuth2.
• Kernel EDR Blinding (BYOVD): Staging signed drivers HWiNFO_x64_206.sys and TRIXX.sys to execute ring-0 kernel writes that disable PspCreateProcessNotifyRoutine callbacks.
• Evasion & Masquerading: Obfuscated binaries disguise as OfficeSupport.exe and WindowsTelemetry.exe, using in-memory process hollowing and XOR stack string decryption.

---

Technical Telemetry & Indicators

Indicator Type	Defanged Value	Operational Role
IPv4 Address	2[.]27[.]63[.]244	Staging & Compilation Node (Fastweb, Italy)
Port / Service	2[.]27[.]63[.]244:9999	Exposed Tooling & Staging Repository
Domain	cdn-staticfiles[.]com	Default Fallback HTTPS C2 Domain
GitHub Relay	derwingoww/edge-nodes	Covert Dead-Drop Relay Repository
Driver (BYOVD)	HWiNFO_x64_206.sys	Vulnerable Signed Driver for Kernel Callback Unhooking
Driver (BYOVD)	TRIXX.sys	Vulnerable Signed Driver for Kernel EDR Blinding
Persistence	OfficeSupport	Scheduled Task (%APPDATA%\Microsoft\Office\OfficeSupport.exe)