Bulletproof Host Gerber EDV Tied to Adwind Botnets

9 April 2018 routine threat

Researcher traces thousands of Adwind/Qrypter RAT C2 servers to a fake Swiss company, Gerber EDV-Dienstleistungen, sharing infrastructure with the AnMaXX bulletproof hosting network.

Abuse.ch researchers tracked nearly 10,000 Adwind (jRAT/JSocket) samples calling back to over 2,800 distinct C&C servers over a six-month period, with most tied to the Qrypter Malware-as-a-Service platform hosted on Tor. Investigation into the hosting infrastructure led to two networks, Gerber EDV-Dienstleistungen (gerber-edv.net) and AnMaXX (anmaxx.net), which share the same IP address and mail server, along with a third domain, rivavpn.com. Both networks advertise themselves as "non-logging VPN" services in RIPE records but have no functioning website.

A physical visit to Gerber's registered Bern office address found no such company present, and no matching entity exists in Switzerland's official business registry, confirming the registration details are fabricated. The analyst concludes Gerber EDV and AnMaXX are operated by the same actors and exist solely to provide bulletproof hosting for Adwind/Qrypter as well as other RAT families including NanoCore and RemcosRAT. RIPE was notified of the fraudulent registration data, though the organization does not verify submitted WHOIS information, allowing such abuse to persist.

The report includes an extensive list of IP netranges tied to Gerber EDV, AnMaXX, and rivavpn.com, plus additional netranges from other providers (including Swiftway, Host1Plus, GigeNET, and others) observed hosting large volumes of Adwind C2 infrastructure, recommending network defenders block these ranges at the perimeter.

Mentioned in this report

Threat actors Gerber EDV-Dienstleistungen

Malware AdWindNanoCoreQrypterRemcos RAT

Detection guidance

Java Process Executing Suspicious Command-Line Arguments Consistent with jRAT

ATT&CK T1059.001

Detects java.exe spawning with command-line arguments typical of Adwind/jRAT execution: classpath references to jar files in temp directories, main class invocation patterns, or encoded/obfuscated payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Executing Suspicious Command-Line Arguments Consistent with jRAT
description: Detects java.exe spawning with suspicious command-line patterns associated
  with Adwind/jRAT botnets. Targets java classpath invocation of jar files from temp/user
  directories and typical obfuscated main class patterns, without matching specific
  campaign identifiers.
tags:
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_java_temp:
    Image|endswith: \java.exe
    CommandLine|contains:
    - '-cp '
    - '-classpath '
    CommandLine|re: (\\AppData\\|\\Temp\\|\\ProgramData\\).*\.jar
  selection_java_encoding:
    Image|endswith: \java.exe
    CommandLine|contains:
    - sun.misc.Unsafe
    - -Xmx
  filter_legitimate_java:
    ParentImage|endswith:
    - \javaw.exe
    - \javapackager.exe
    CommandLine|contains:
    - maven
    - gradle
    - tomcat
  condition: (selection_java_temp or selection_java_encoding) and not filter_legitimate_java
falsepositives:
- Legitimate Java applications launched from temp directories during installation
  or update
- Development tools (Maven, Gradle) invoking Java with classpath arguments
level: medium
id: 0b79c867-39ff-57af-8fd4-e5cca1810c96
status: experimental
author: Vorant

Executable or Archive Delivery via Email Client Process Creation

ATT&CK T1566.001

Detects email client processes (Outlook, Thunderbird) spawning child processes that extract, decompress, or execute files—typical of phishing attachment delivery leading to jRAT/Adwind infection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Executable or Archive Delivery via Email Client Process Creation
description: Detects email clients (Outlook, Thunderbird, etc.) spawning extraction
  or execution processes (7zip, WinRAR, cmd, powershell, rundll32) immediately after
  attachment interaction. Targets the parent/child process relationship typical of
  phishing payloads triggering malware installation.
tags:
- attack.execution
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_email_parent:
    ParentImage|endswith:
    - \OUTLOOK.EXE
    - \thunderbird.exe
  selection_extraction:
    Image|endswith:
    - \7z.exe
    - \7zG.exe
    - \WinRAR.exe
    - \Rar.exe
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    - \msiexec.exe
  filter_outlook_plugins:
    CommandLine|contains:
    - outlook.exe
    - -embedding
  condition: selection_email_parent and selection_extraction and not filter_outlook_plugins
falsepositives:
- Corporate email security add-ins that scan or decompress attachments
- Legitimate plugins or extensions for email clients that unpack content
level: high
id: 9bce7395-0a28-5aee-8092-9d69e92fa276
status: experimental
author: Vorant

Network Connection to Known Bulletproof Hosting Provider Netranges

ATT&CK T1583.003

Detects outbound TCP connections from user processes to IP address ranges operated by known bulletproof hosting providers (Gerber EDV, AnMaXX, Swiftway, Host1Plus, GigeNET, etc.) observed hosting Adwind C&C infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Network Connection to Known Bulletproof Hosting Provider Netranges
description: Detects outbound TCP connections from non-system processes to CIDR ranges
  of bulletproof hosting providers known to host Adwind/jRAT C&C servers. This rule
  should be updated regularly with current netranges from threat intelligence feeds
  tracking these providers.
tags:
- attack.command-and-control
- attack.t1583.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
    - 3306
    - 5900
    DestinationIp|cidr:
    - 0.0.0.0/0
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  filter_system:
    Image|endswith:
    - \svchost.exe
    - \System
    - \lsass.exe
    - \explorer.exe
  condition: selection and not filter_private and not filter_system
falsepositives:
- Legitimate cloud service connections to shared hosting providers
- Updates or telemetry sent to services hosted on these providers
level: low
id: f0dbea32-3691-5718-9bc3-5ee721b19840
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://abuse.ch/blog/anmaxx-gerber-edv-and-the-qrypter-connection

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free