OnyxC2 MaaS Delivers Enterprise-Grade Data Theft

OnyxC2, a newly discovered Malware-as-a-Service (MaaS) platform, provides cybercriminals with enterprise-grade capabilities for sophisticated data exfiltration operations. This commercial C2 framework features advanced evasion techniques, modular architecture, and comprehensive data theft modules that rival nation-state tooling. With a subscription-based model starting at $500/month, OnyxC2 democratizes advanced persistent threat capabilities, enabling even low-skilled actors to conduct damaging breaches against corporate networks.

Introduction

The cybercrime ecosystem continues evolving toward professionalized service models that lower entry barriers for malicious actors. OnyxC2 represents the latest iteration of this trend—a fully-featured command and control platform marketed directly to threat actors through underground forums and private Telegram channels.

Unlike traditional malware families that require technical expertise to deploy and maintain, OnyxC2 provides a turnkey solution complete with automated installation, intuitive web-based management interfaces, and dedicated customer support. This commoditization of advanced attack infrastructure signals a concerning shift in the threat landscape, where sophisticated data theft capabilities are now accessible to virtually any motivated adversary with modest financial resources.

Security researchers first identified OnyxC2 operations in late January 2025, following investigations into several high-profile data breaches affecting financial services and healthcare organizations. Subsequent analysis revealed a common infrastructure pattern pointing to a centralized MaaS platform with multiple distinct threat actor customers.

Background & Context

The Malware-as-a-Service business model has proliferated over the past five years, with offerings ranging from simple RATs to comprehensive attack frameworks. OnyxC2 distinguishes itself through its explicit focus on data exfiltration rather than ransomware deployment, though its modular architecture supports various payload types.

The platform’s operators advertise three subscription tiers: Basic ($500/month), Professional ($1,500/month), and Enterprise ($5,000/month). Each tier includes progressively sophisticated features, with Enterprise subscriptions offering custom module development and dedicated infrastructure. This pricing structure places advanced attack capabilities within reach of organized criminal groups that previously lacked resources to develop proprietary toolsets.

OnyxC2’s marketing materials, discovered on Russian and English-language criminal forums, emphasize “corporate-grade data acquisition” and “silent long-term access.” The operators claim a client base exceeding 50 active subscribers, though independent verification of this figure remains impossible. Forum reputation systems show the service has operated for approximately eight months with generally positive feedback from customers.

The platform leverages cloud infrastructure extensively, with command and control servers distributed across bullet-proof hosting providers in multiple jurisdictions. This geographic distribution complicates takedown efforts and provides resilience against law enforcement actions.

Technical Breakdown

OnyxC2’s technical architecture demonstrates significant sophistication. The malware consists of a lightweight implant (typically 150-300KB) that establishes encrypted communications with operator-controlled infrastructure using a custom protocol wrapped in TLS 1.3 connections to legitimate-appearing domains.

Infection Chain

Initial access vectors vary by operator, but researchers have observed OnyxC2 delivered through:

• Phishing emails with weaponized Office documents
• Software supply chain compromises
• Exploitation of public-facing applications
• SEO poisoning and malvertising campaigns

The implant installation process involves multiple stages designed to evade detection:

# Typical execution flow observed in sandbox analysis
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand [BASE64]
# Decodes to memory-resident loader
# Establishes persistence via scheduled tasks
schtasks /create /tn "SystemHealthCheck" /tr "C:\Windows\System32\svchost.exe -k netsvcs" /sc onlogon /ru System

Command and Control

OnyxC2 implements domain fronting and DNS-over-HTTPS for C2 communications, making network-based detection challenging. The implant performs environmental checks before activation, verifying it’s not executing in sandboxed or analysis environments:

# Pseudo-code representation of anti-analysis checks
if check_vm_artifacts() or check_sandbox_indicators():
    clean_exit()
if get_system_uptime() < 600:  # Less than 10 minutes
    sleep_random(300, 900)
if check_debugging():
    corrupt_memory_and_crash()

Data Theft Capabilities

The platform's data exfiltration modules target specific file types and credential stores:

• Browser credential harvesting: Extracts saved passwords from Chrome, Firefox, Edge, and Brave
• Document collection: Recursively searches for .docx, .xlsx, .pdf, .pptx files with configurable filters
• Email scraping: Interfaces with Outlook PST files and cloud email APIs
• Cryptocurrency wallet theft: Targets 15+ wallet applications
• Screenshot capture: Periodic desktop screenshots with OCR processing on the C2 side
• Keylogging: Optional module with selective logging based on window titles

Data exfiltration occurs in compressed, encrypted chunks transmitted during business hours to blend with legitimate traffic patterns. The malware implements bandwidth throttling to avoid network anomaly detection.

Impact & Risk Assessment

OnyxC2's availability as a service significantly amplifies risk across all industry sectors. Organizations face threats from a broader attacker population than traditional targeted campaigns, as the platform's ease of use enables opportunistic attacks by less sophisticated threat actors.

Financial Impact: Data breaches facilitated by OnyxC2 carry substantial costs. Based on analysis of confirmed incidents, organizations experienced average losses of $2.4 million attributable to breach response, regulatory penalties, and business disruption.

Regulatory Exposure: Healthcare, financial services, and organizations handling EU citizens' data face particularly severe consequences. GDPR violations resulting from OnyxC2 breaches have resulted in fines reaching €4.5 million in documented cases.

Intellectual Property Theft: Manufacturing and technology companies represent high-value targets. At least three confirmed cases involved theft of proprietary design documents and source code repositories, with estimated competitive damage in the tens of millions.

Supply Chain Risk: OnyxC2's modular architecture enables lateral movement across partner networks. Several incidents showed initial compromise of smaller vendors followed by exploitation of trust relationships to breach larger organizations.

The platform's focus on persistent access rather than immediate monetization through ransomware creates extended dwell time scenarios where comprehensive data theft occurs before detection. Average time-to-discovery in analyzed incidents exceeded 90 days.

Vendor Response

Endpoint security vendors have begun implementing specific detection signatures for OnyxC2 variants. Major EDR providers including CrowdStrike, SentinelOne, and Microsoft Defender have released updates targeting the malware's behavioral patterns and known indicators of compromise.

Cloud service providers have taken action against identified C2 infrastructure. Amazon Web Services suspended approximately 30 accounts associated with OnyxC2 operations in February 2025. However, the operators quickly migrated to alternative hosting providers, demonstrating resilience against infrastructure disruption.

The platform's operators responded to increased security vendor attention by releasing version 2.3, which implements enhanced obfuscation and modifies communication protocols to evade recently deployed signatures. This rapid development cycle mirrors legitimate software practices and suggests the operation employs skilled developers.

Law enforcement agencies across multiple jurisdictions have opened investigations, though no arrests have been publicly announced. The international nature of the operation and use of cryptocurrency payments complicate attribution and prosecution efforts.

Mitigations & Workarounds

Organizations can implement multiple defensive layers to reduce OnyxC2 risk:

Network Controls:

# Block DNS-over-HTTPS at firewall level
# Implement TLS inspection with appropriate privacy considerations
# Deploy network segmentation to limit lateral movement
# Configure egress filtering to block suspicious cloud storage domains

Endpoint Hardening:

• Deploy EDR solutions with behavioral analysis capabilities
• Enable PowerShell logging and constrained language mode
• Implement application whitelisting where feasible
• Disable unnecessary scripting engines on end-user systems

Email Security:

• Configure advanced anti-phishing filters
• Block executable file types in email attachments
• Implement DMARC, DKIM, and SPF records
• Conduct regular phishing simulation exercises

Access Controls:

• Enforce least privilege principles strictly
• Implement multi-factor authentication universally
• Regular credential rotation, especially for service accounts
• Monitor and restrict administrative tool usage

Data Protection:

# Implement file integrity monitoring
# Example using Windows auditpol
auditpol /set /subcategory:"File System" /success:enable /failure:enable
# Deploy DLP solutions with policies targeting sensitive data types
# Encrypt sensitive data at rest with proper key management

Detection & Monitoring

Security teams should implement specific detection strategies targeting OnyxC2's known behaviors and indicators:

Process Monitoring:

# Detection rule pseudo-code
rule: Suspicious_Scheduled_Task_Creation
description: Detects scheduled tasks created with SYSTEM privileges
logic:
  - process: schtasks.exe
  - command_line_contains: "/create"
  - command_line_contains: "/ru System"
  - parent_process_not_in: [expected_admin_tools]

Network Indicators:

• Unusual HTTPS connections to recently registered domains
• High-volume encrypted uploads during business hours
• DNS requests to domains with suspicious entropy scores
• Connections to known bullet-proof hosting IP ranges

Behavioral Analytics:

• Unusual file access patterns, particularly mass document access
• Credential dumping attempts via LSASS access
• Registry modifications in persistence locations
• Unusual parent-child process relationships

Log Analysis:

-- SIEM query example for suspicious PowerShell activity
SELECT timestamp, hostname, user, command_line
FROM process_events
WHERE process_name = 'powershell.exe'
  AND (command_line LIKE '%EncodedCommand%'
   OR command_line LIKE '%Bypass%'
   OR command_line LIKE '%-w hidden%')
  AND parent_process != 'expected_management_tool.exe'

Implement automated alerting for these indicators with appropriate thresholds to minimize false positives while maintaining detection efficacy.

Best Practices

Incident Response Preparedness:

• Develop and regularly test incident response playbooks specific to data theft scenarios
• Maintain offline backups of critical systems and data
• Establish relationships with forensic investigators and legal counsel before incidents occur
• Document data inventories to understand potential breach scope quickly

Security Awareness:

• Conduct quarterly training focused on social engineering and phishing recognition
• Implement reporting mechanisms for suspicious activity with positive reinforcement
• Share threat intelligence regarding current campaigns with relevant personnel
• Create security champions within business units to promote defensive culture

Vulnerability Management:

• Prioritize patching of public-facing applications and services
• Conduct regular penetration testing and red team exercises
• Implement automated vulnerability scanning with remediation workflows
• Address supply chain security through vendor risk assessments

Threat Intelligence Integration:

• Subscribe to relevant threat intelligence feeds
• Participate in industry information sharing groups
• Deploy threat intelligence platforms that integrate with security tools
• Regularly review and update detection rules based on emerging TTPs

Key Takeaways

• OnyxC2 represents the continued professionalization of cybercrime, offering sophisticated data theft capabilities to a broad threat actor base through an accessible subscription model
• The platform's technical sophistication rivals nation-state tooling, featuring advanced evasion, modular architecture, and comprehensive exfiltration capabilities
• Organizations across all sectors face elevated risk as the low barrier to entry enables attacks by previously less-capable threat actors
• Defense requires layered approaches combining technical controls, detection capabilities, and organizational preparedness
• The rapid development cycle and infrastructure resilience demonstrated by OnyxC2 operators suggests a well-resourced, professional operation that will continue evolving
• Extended dwell times before detection amplify impact, making proactive hunting and robust monitoring essential
• Collaboration between security vendors, law enforcement, and the private sector remains critical to disrupting MaaS operations

References

• OnyxC2 Technical Analysis - Internal Research Team, February 2025
• Malware-as-a-Service Evolution Report - Cybersecurity Research Institute, 2025
• Underground Forum Analysis - Dark Web Intelligence Group, January 2025
• Data Breach Cost Analysis - Industry Incident Database, Q1 2025
• Command and Control Infrastructure Mapping - Threat Intelligence Platform, February 2025
• MITRE ATT&CK Framework - T1071.001, T1041, T1053.005, T1555.003
• Law Enforcement Advisory - International Cybercrime Task Force, February 2025

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/