Executive Summary
Blackpoint’s Adversary Pursuit Group (APG) has uncovered Miraak, a previously undocumented and modular post-exploitation framework. The discovery stemmed from an adversary operational security (OPSEC) failure where binaries and configuration files were left exposed in open web directories. Miraak is notable for its mature feature set, including command execution, process control, and an asynchronous job model, all managed through a database-backed control plane rather than traditional HTTP/S beacons.
Technically, Miraak utilizes cloud-hosted PostgreSQL and Timescale infrastructure to handle tasking and results, blending its C2 traffic into encrypted database sessions. The framework employs malicious DLLs that mimic legitimate .NET runtime components (hostfxr.dll) and supports the execution of Cobalt Strike Beacon Object Files (BOFs). Additionally, a separate F#-based tunneling implant was identified, which leverages trojanized DocFX dependencies to provide network pivoting capabilities.
This framework represents a significant threat because it allows attackers to maintain persistent control and move laterally within victim environments while evading detections focused on conventional web-based malware traffic. The use of database protocols for C2 highlights a shift toward blending malicious activity into common enterprise cloud service traffic.