Miraak moves its command and control into cloud PostgreSQL traffic

Blackpoint's directory listing shows dotnet.exe sitting next to a collocated hostfxr.dll ^[2], the sideload pair that beats binary trust, and the malicious hostfxr.dll variants abuse trusted .NET naming and load paths ^[5]. Execution starts from a legitimately named host process, and the attacker code arrives as a dependency that process is expected to load. Heuristics keyed to unsigned or oddly named executables see a .NET runtime doing .NET runtime work. The tunnel follows the same convention with doccache.dll staged beside docfx.exe and Microsoft.DocAsCode.Common.dll ^[9]. Across both exposed directories that is three benign-looking executables and two DLLs named after legitimate components ^[11].

On the network side, a beacon detection is looking for periodic outbound HTTP with jitter and a suspicious destination. Miraak's equivalent telemetry is an encrypted session to a cloud-hosted database service that plenty of estates legitimately use ^[4]. That does not make it invisible, but it moves the hunt from signature to asset context: an application server talking to managed PostgreSQL is expected, and a user endpoint doing it is not. Anyone whose egress policy stops at web proxy categories has no place to put that question.

The operator economics matter more than the novelty. The agent already covers shell execution, process control, screenshots, file transfer, discovery, sleep control, and asynchronous jobs ^[6], and Miraak implements Cobalt Strike Beacon Object File compatibility so existing BOFs run against Miraak's own tasking infrastructure ^[7]. An operator can keep their tooling and drop the traffic pattern their tooling is known by. Framework is packaged multiple ways around one operator architecture ^[13], so hash-based indicators from this batch will age quickly.

Blackpoint published a framework teardown, built from artifacts rather than an incident report. The write-up does not name a threat actor or victim, and it does not give dates ^[14]; the statement that Miraak can turn one compromised endpoint into broader access is Blackpoint's characterization of capability ^[10]. Nothing here is a vulnerability, so there is no patch deadline to work to. Triage runs on artifacts instead: an agent decoded to %TEMP%\msedgeupdate.exe, a miraak.conf on disk ^[5], and infrastructure presenting a TLS certificate labeled miraak-socks in front of an F# reverse TCP tunnel ^[8]. Those three came from an operator mistake, so they are cheap to search for right now, but they are also the details most likely to change once the operators clean up after themselves. The database control plane and the .NET load path are architectural choices baked into how Miraak works, and they will be slower to move.