Bulletproof Host Gerber EDV Tied to Adwind Botnets
Researcher traces thousands of Adwind/Qrypter RAT C2 servers to a fake Swiss company, Gerber EDV-Dienstleistungen, sharing infrastructure with the AnMaXX bulletproof hosting network.
Sourceabuse.ch — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Abuse.ch researchers tracked nearly 10,000 Adwind (jRAT/JSocket) samples calling back to over 2,800 distinct C&C servers over a six-month period, with most tied to the Qrypter Malware-as-a-Service platform hosted on Tor. Investigation into the hosting infrastructure led to two networks, Gerber EDV-Dienstleistungen (gerber-edv.net) and AnMaXX (anmaxx.net), which share the same IP address and mail server, along with a third domain, rivavpn.com. Both networks advertise themselves as "non-logging VPN" services in RIPE records but have no functioning website.
A physical visit to Gerber's registered Bern office address found no such company present, and no matching entity exists in Switzerland's official business registry, confirming the registration details are fabricated. The analyst concludes Gerber EDV and AnMaXX are operated by the same actors and exist solely to provide bulletproof hosting for Adwind/Qrypter as well as other RAT families including NanoCore and RemcosRAT. RIPE was notified of the fraudulent registration data, though the organization does not verify submitted WHOIS information, allowing such abuse to persist.
The report includes an extensive list of IP netranges tied to Gerber EDV, AnMaXX, and rivavpn.com, plus additional netranges from other providers (including Swiftway, Host1Plus, GigeNET, and others) observed hosting large volumes of Adwind C2 infrastructure, recommending network defenders block these ranges at the perimeter.
Mentioned in this report
Detection guidance
Java Process Executing Suspicious Command-Line Arguments Consistent with jRAT
A behavioural hunt for the technique in general.
Detects java.exe spawning with command-line arguments typical of Adwind/jRAT execution: classpath references to jar files in temp directories, main class invocation patterns, or encoded/obfuscated payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Executing Suspicious Command-Line Arguments Consistent with jRAT
description: Detects java.exe spawning with suspicious command-line patterns associated
with Adwind/jRAT botnets. Targets java classpath invocation of jar files from temp/user
directories and typical obfuscated main class patterns, without matching specific
campaign identifiers.
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection_java_temp:
Image|endswith: \java.exe
CommandLine|contains:
- '-cp '
- '-classpath '
CommandLine|re: (\\AppData\\|\\Temp\\|\\ProgramData\\).*\.jar
selection_java_encoding:
Image|endswith: \java.exe
CommandLine|contains:
- sun.misc.Unsafe
- -Xmx
filter_legitimate_java:
ParentImage|endswith:
- \javaw.exe
- \javapackager.exe
CommandLine|contains:
- maven
- gradle
- tomcat
condition: (selection_java_temp or selection_java_encoding) and not filter_legitimate_java
falsepositives:
- Legitimate Java applications launched from temp directories during installation
or update
- Development tools (Maven, Gradle) invoking Java with classpath arguments
level: medium
id: 0b79c867-39ff-57af-8fd4-e5cca1810c96
status: experimental
author: Vorant
Executable or Archive Delivery via Email Client Process Creation
A behavioural hunt for the technique in general.
Detects email client processes (Outlook, Thunderbird) spawning child processes that extract, decompress, or execute files—typical of phishing attachment delivery leading to jRAT/Adwind infection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable or Archive Delivery via Email Client Process Creation
description: Detects email clients (Outlook, Thunderbird, etc.) spawning extraction
or execution processes (7zip, WinRAR, cmd, powershell, rundll32) immediately after
attachment interaction. Targets the parent/child process relationship typical of
phishing payloads triggering malware installation.
tags:
- attack.execution
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_email_parent:
ParentImage|endswith:
- \OUTLOOK.EXE
- \thunderbird.exe
selection_extraction:
Image|endswith:
- \7z.exe
- \7zG.exe
- \WinRAR.exe
- \Rar.exe
- \cmd.exe
- \powershell.exe
- \rundll32.exe
- \msiexec.exe
filter_outlook_plugins:
CommandLine|contains:
- outlook.exe
- -embedding
condition: selection_email_parent and selection_extraction and not filter_outlook_plugins
falsepositives:
- Corporate email security add-ins that scan or decompress attachments
- Legitimate plugins or extensions for email clients that unpack content
level: high
id: 9bce7395-0a28-5aee-8092-9d69e92fa276
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://abuse.ch/blog/anmaxx-gerber-edv-and-the-qrypter-connection
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs