Deimos Remote Access Tool: Updated TTPs and Elastic Security C2 Takedown

What happened

The Elastic Security team discovered a new strain of the Deimos remote‑access implant, first seen in 2020, that has been actively refined with advanced obfuscation, encryption, and digitally signed lure files. A recent takedown of the implant’s command‑and‑control infrastructure was completed, exposing the C2 domains and IPs used by the malware.

Impact

Deimos provides attackers with initial foothold, persistence, and full C2 capabilities. The use of convincing signed executables and multi‑layer obfuscation makes detection difficult, allowing the implant to remain hidden in compromised environments and potentially be sold to other threat actors.

What to do

• Block the known C2 domains and IP addresses listed in the takedown report.
• Deploy Elastic Security detection rules that flag execution of signed binaries with suspicious file paths or hash patterns matching Deimos samples.
• Monitor for outbound traffic to the identified C2 endpoints and for processes that spawn remote shells or download additional payloads.
• Verify the integrity of signed installers by checking publisher certificates against known malicious issuers.
• Apply the provided hunting queries to search for the implant’s unique indicators of compromise in your logs.

Mitigation

Implement least‑privilege access controls, enforce application whitelisting, and enable file integrity monitoring to detect unauthorized signed binaries. Keep the Elastic Stack updated with the latest detection rules and threat intelligence feeds.