IoChecker

In the ever-evolving landscape of cybersecurity threats, traditional static methods of assessing malicious IP addresses and the (continued) validity of corresponding threat indicators (IoCs) often fall short, leading to a high rate of false positives . This is where IoChecker steps in, offering a dynamic and data-driven solution.

IoChecker leverages the internet scanner Censys to dynamically assess whether an IP address that was designated as malicious is in fact still under the control of an attacker. By continuously scanning and analysing real-time data, IoChecker provides a more accurate and up-to-date designation of malicious IPs than traditional static methods. This dynamic approach significantly reduces the likelihood of false positives and negatives, thus ensuring that security teams can focus on genuine (current) threats and respond more effectively. By looking at a variety of features available in the Censys data set, a change in ownership of a Command and Control (C2) server is immediately detected. IoChecker was successfully tested on four malware families, namely BazarLoader, BumbleBee, Emotet and QakBot.

This work will be presented December 15^th 2024 at the CyberHunt 2024 conference, in Washington, D.C. The corresponding paper will be published in the proceedings.