Operation STANDOFF Malware Hides C2 Traffic with GitHub Redirects

Key Takeaways

• Operation STANDOFF is a sophisticated, Russian-speaking cybercrime campaign that leverages a “pay-per-install” model to deploy multiple malware families.
• The campaign utilizes a unique infrastructure trick: C2 servers issue HTTP 301 redirects to GitHub for unsolicited requests, making them appear benign during superficial scans.
• Infected systems are burdened with information stealers (RedLine, Raccoon Stealer), loaders (Amadey, SmokeLoader, Socelars, Glupteba), a cryptocurrency miner (XMRig), and botnet components.
• Victims’ machines can be transformed into proxy relays for attacker traffic, and stolen credentials, browser data, and Active Directory information pave the way for deeper network intrusions.
• The campaign employs gaming-themed lures and automated social engineering to draw targets into its malware ecosystem, complicating detection and containment efforts for security teams.

A Russian-speaking cybercrime group, dubbed “Operation STANDOFF,” is executing a multi-faceted intrusion campaign that transforms initial infections into extensive network compromises. This sophisticated operation deploys a diverse arsenal of malware, ranging from information stealers to cryptocurrency miners, and utilizes a clever command-and-control (C2) infrastructure that masks malicious traffic through GitHub redirects.

The campaign’s modus operandi involves a “pay-per-install” mechanism, where a single initial infection delivers a bundle of malicious payloads. This approach allows the operators to cast a wide net, compromising numerous systems before selectively focusing on high-value targets for direct network intrusions. The threat actors also employ gaming-related content and automated outreach to entice potential victims into their malware delivery ecosystem.

Researchers at VMRay were instrumental in uncovering the full scope of Operation STANDOFF. They meticulously connected seemingly disparate activities, including unusual network requests, dropped files, and shared server infrastructure, to reveal the campaign’s unified nature. VMRay said in a report that this campaign masterfully blends mass malware distribution, a proxy botnet, specialized intrusion tools, and even AI-driven influence operations.

The consequences of a STANDOFF infection extend far beyond simple data theft. Compromised devices are often co-opted as relay points for the attackers’ network traffic, effectively turning victims into unwitting participants in further malicious activities. The theft of credentials, browser data, session cookies, and Active Directory information provides a critical foothold for lateral movement and deeper penetration into corporate networks. Furthermore, the deployment of multiple malware payloads simultaneously presents a significant challenge for security teams, as they must contend with various persistence mechanisms and malicious processes concurrently, complicating containment and remediation efforts.

Operation STANDOFF’s Evasive C2 Infrastructure

One of the most noteworthy aspects of Operation STANDOFF’s infrastructure is its use of HTTP 301 redirects to GitHub. When unsolicited requests are sent to certain C2 servers, they respond with a redirect to github[.]com. This tactic is designed to make suspicious hosts appear as legitimate redirectors during rapid network scans, allowing the actual C2 infrastructure to blend seamlessly with traffic patterns associated with a trusted service like GitHub. It is crucial to note that GitHub itself has not been compromised or implicated in this campaign; its platform is merely being abused as a redirection destination.

For instance, the proxy-list server at 212.193.30.45 delivered a proxies.txt file to infected machines while simultaneously redirecting generic HTTP requests to GitHub. This behavior was a key indicator that allowed analysts to link this activity to a broader cluster of campaign infrastructure. In contrast, a separate host, 212.193.30.29, which served the STANDOFF COORD operator console, employed a standard HTTP-to-HTTPS redirect, highlighting a deliberate distinction in the C2 communication strategies. This layered approach to C2 infrastructure is a testament to the group’s sophistication, reminiscent of other threat actors who exploit legitimate online services to mask their illicit activities.

Malware, Proxies, and Intrusions

Upon initial infection, the loader component of Operation STANDOFF drops numerous executables into a user-writable staging directory. It then uses obscured command-line activity to launch these payloads. To ensure persistence and hinder detection, the malware attempts to disable Microsoft Defender, scans for security tools and virtual machine environments, and establishes persistence through various methods, including registry entries, scheduled tasks, services, and startup items. These actions are designed to maximize the malware’s operational time, enabling extensive data exfiltration and maintaining attacker access to compromised systems.

The deployed malware families serve various nefarious purposes. One component is dedicated to harvesting browser credentials, cryptocurrency wallet information, and capturing screenshots. Other modules facilitate botnet control or engage in illicit cryptocurrency mining. The proxy functionality is particularly alarming, as it transforms victim machines into involuntary traffic relays, a tactic frequently observed in proxy botnet abuse cases. The inclusion of RedLine, a potent information stealer, further escalates the risk, as it is designed to exfiltrate sensitive user data, setting the stage for subsequent, more targeted attacks.

The presence of the STANDOFF COORD console suggests that the group may be coordinating human operators for targeted attacks against enterprise environments. This console tracks systems by network segment (internal, external, DMZ), stores credentials and Kerberos tickets, and includes features for shared notes, tasks, and victim scoring. This level of organization points to a sophisticated and persistent threat.

What You Should Do

• Block Indicators of Compromise (IoCs): Immediately implement blocks for all listed IP addresses and domains in your firewalls, IDS/IPS, and DNS filters.
• Monitor Outbound Traffic: Actively monitor for suspicious outbound network requests, especially those to the listed C2 IPs, and scrutinize any unexpected redirects to trusted domains like GitHub.
• Protect Privileged Accounts: Enforce strong password policies, multi-factor authentication (MFA), and regularly audit privileged accounts. Refer to an Active Directory attack checklist to mitigate credential theft and lateral movement risks.
• Scrutinize Executables: Watch for unsigned executables launching from user-writable directories (e.g., %LOCALAPPDATA%), unexpected changes to Microsoft Defender configurations, suspicious scheduled tasks, and malformed WinHTTP user-agent values.
• Validate Redirects: Treat redirects to legitimate domains with suspicion. Always validate the server, certificate, network ownership, requested resource, and the process initiating the connection before deeming activity benign.
• Rapid Incident Response: Isolate any affected hosts immediately upon detection of suspicious activity to prevent a single infection from escalating into a wider network compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.