Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<h1>Introducing Cavalier’s New Threat Feeds: Deep Dive into Infostealer C2 Intelligence</h1>
<p>We are thrilled to introduce three new Threat Feed modules in Cavalier: <strong>C2 Data</strong>, <strong>ClickFix</strong>, and <strong>PhaaS (Phishing-as-a-service)</strong>. Together, they give security teams comprehensive visibility into active attacker infrastructure – from infostealer command-and-control (C2) servers to malicious ClickFix pages executing clipboard injection, to turnkey Phishing-as-a-service (PhaaS) kits targeting corporate credentials.</p>
<img alt="Overview of the Threat Feeds monitoring options" src="https://www.infostealers.com/wp-content/uploads/2026/07/threatfeeds1.png" />
Overview of the new Threat Feeds monitoring options available inside Cavalier.
<h2>What’s New: Infostealers C2 Data</h2>
<p>The new C2 Data module provides unprecedented access to observed command-and-control (C2) hosts associated directly with active infostealer campaigns. This empowers security teams to transition from reactive incident response to preemptive blocking.</p>
<img alt="Overview of the infostealers C2 monitoring" src="https://www.infostealers.com/wp-content/uploads/2026/07/c2_1.png" />
A high-level overview of the Infostealers C2 monitoring dashboard, displaying active threat infrastructure.
<p>Inside Cavalier, you can seamlessly review:</p>
<ul>
<li>Daily Infostealers C2 host feeds</li>
<li>Activity trends over time</li>
<li>Top countries where C2 hosts are observed</li>
<li>Malware family breakdowns</li>
<li>Detailed host information, including infrastructure type, ASN, AS organization, ports, tags, first seen, and last seen</li>
</ul>
<h2>Uncovering Initial Access with Correlated Intelligence</h2>
<p>One of the most powerful features of the C2 Intelligence Feed is the integration of <strong>Infostealer credential telemetry linked to the hosting platform</strong>. This shows compromised employee or user credentials that likely enabled the threat actors to gain initial access to the server in the first place.</p>
<img alt="Specific infostealers C2 examples with correlated infection data" src="https://www.infostealers.com/wp-content/uploads/2026/07/c2_2.png" />
Specific infostealer C2 examples (Redline, Vidar, Stealc, etc.) enriched with correlated infection data from Hudson Rock’s cybercrime intelligence database, revealing compromises associated with the server.
<p>For example, you can open a host such as <em>myrtler(.)biz</em> and immediately see that it’s associated with the Vidar malware family, along with its DNS activity, first-seen date, and critical infrastructure details as they are actively observed.</p>
<img alt="Overview of various families sorted by 30 days volume" src="https://www.infostealers.com/wp-content/uploads/2026/07/c2_3.png" />
An overview of various infostealer families, sorted by 30-day activity volume to help prioritize defense efforts.
<h2>Seamless API Integration for Proactive Defense</h2>
<p>To truly block active command-and-control channels at the firewall or proxy level – stopping infected endpoints from exfiltrating credentials, receiving instructions, or dropping secondary payloads – automation is key.</p>
<img alt="API overview" src="https://www.infostealers.com/wp-content/uploads/2026/07/c2_4.png" />
Overview of the C2 Host Feed REST API endpoint for seamless integration.
<p>All C2 datasets are fully accessible via REST API endpoints for seamless integration into your existing security stack. Using the <a href="https://docs.hudsonrock.com/reference/getc2feed" rel="noreferrer" target="_blank"><code>GET /json/v3/threat-feeds/c2</code></a> endpoint, teams can retrieve observed infostealer C2 hosts with granular filters for host, malware family, country, ASN, feed type, date, and pagination.</p>
<div>
<h3>Protect Your Organization from Imminent Intrusions</h3>
<p>With our new Threat Feeds, cybersecurity teams can monitor live C2 infrastructure from infostealer campaigns, ClickFix networks, and PhaaS (Phishing-as-a-service) operations to proactively block malicious communications.</p>
<p>To learn more about how Hudson Rock protects companies from intrusions caused by info-stealer infections of employees, partners, and users, and how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us, here:<br />
<a href="https://www.hudsonrock.com/schedule-demo" rel="noreferrer" target="_blank">https://www.hudsonrock.com/schedule-demo</a></p>
<p>We also provide access to various free cybercrime intelligence tools that you can find here:<br />
<a href="https://www.hudsonrock.com/free-tools" rel="noreferrer" target="_blank">www.hudsonrock.com/free-tools</a></p>
<p><strong>Thanks for reading, Rock Hudson Rock!</strong><br />
Follow us on LinkedIn: <a href="https://www.linkedin.com/company/hudson-rock" rel="noreferrer" target="_blank">https://www.linkedin.com/company/hudson-rock</a><br />
Follow us on Twitter: <a href="https://www.twitter.com/RockHudsonRock" rel="noreferrer" target="_blank">https://www.twitter.com/RockHudsonRock</a></p>
</div>
The post Introducing Cavalier’s ‘New Threat’ Feeds: Deep Dive into Infostealer C2 Intelligence appeared first on InfoStealers.
Article Link: Introducing Cavalier's 'New Threat' Feeds: Deep Dive into Infostealer C2 Intelligence | InfoStealers