Hi chronic,

We now know that all comms implant to C2 are TLS with a unique (fake) certificate tree. They use unique, single use domains for operations. I don't believe there was enough information in vault 7 to identify IOC's that could be used for behavioural analysis. We also now know that the C2 fronting servers negotiate 'Client Cert optional', which is a fairly unique configuration item.

The git repo contains 3 binary builds of the client/server malware. I think this is more important for detection than their docs.

Regardless, its all public domain now.