Key Takeaways

  • Cavalier has expanded with feeds covering infostealer C2 hosts, ClickFix pages and Phishing-as-a-service kits.
  • Correlated credential telemetry can help investigators connect malicious infrastructure with possible initial-access compromises.
  • A REST API allows security teams to automate indicator ingestion, but validation and access controls remain important.

Hudson Rock has added new threat-feed modules to Cavalier, broadening the cybercrime intelligence platform's coverage of infrastructure used to steal credentials and establish access to corporate systems.

The additions cover C2 Data, ClickFix and PhaaS, short for Phishing-as-a-service. Each addresses a different part of the attacker ecosystem. C2 Data tracks command-and-control hosts associated with infostealer campaigns. ClickFix focuses on malicious pages that use deceptive prompts and clipboard injection. PhaaS monitors packaged phishing operations designed to capture corporate credentials.

The C2 Data module presents daily host feeds, activity trends, country-level observations and breakdowns by malware family. Analysts can also inspect infrastructure type, autonomous system number, AS organization, ports, tags and first-seen and last-seen dates.

That level of context matters because an IP address or domain alone often tells a defender very little. Infrastructure changes quickly, hosting can be shared and an indicator may lose relevance between discovery and deployment. Details about malware families, network ownership and observation periods can help teams decide whether to block an indicator, monitor it or investigate related endpoint activity.

The platform provides relational context through correlated infection data rather than just delivering a list of domains. Cavalier connects observed C2 infrastructure with credential telemetry from the vendor's cybercrime intelligence database, potentially exposing employee or user compromises associated with the hosting environment. According to the company's Cavalier documentation, its database contains information from more than 30,000,000 compromised computers and is updated daily.

The underlying records can be extensive. Intelligence data indicates infostealer logs may contain passwords, cookies, autofill information, VPN and SSH credentials, application credentials and credit card data. That mix creates risk beyond a conventional password leak. Stolen browser cookies may assist with session hijacking, while VPN or administrative credentials can give attackers a route toward sensitive systems.

Cavalier's interface can, for example, identify the defanged host myrtler(.)biz as associated with Vidar and display its DNS activity, first-seen date and infrastructure details. Other supported infostealer examples include RedLine and Stealc. The platform also sorts malware families by activity over a 30-day period, giving defenders one way to prioritize investigations.

Credential-centered searches are already part of the wider infostealer intelligence market. Infostealers.com has documented searches for leaked credentials by username, while Ransomware.live tracks infostealer-related intelligence in the context of ransomware risk. Together, those use cases reflect a practical shift: teams are increasingly examining credential exposure before a disruptive incident rather than only after one.

Automation is supported natively. Cavalier exposes C2 datasets through the GET /json/v3/threat-feeds/c2 REST API endpoint. Teams can filter results by host, malware family, country, ASN, feed type and date, with pagination for larger result sets. That makes it possible to route indicators into firewalls, proxies, security information and event management systems, endpoint tools or orchestration workflows.

Still, automatic blocking needs guardrails. Security operations teams must account for indicator age, confidence, shared infrastructure and business dependencies before enforcing a policy. A domain seen in malicious traffic yesterday may warrant different treatment from an IP address last observed weeks earlier. Logging each automated action also supports later review.

The feeds align with MITRE ATT&CK-based detection work and the NIST Cybersecurity Framework, particularly around identifying exposed assets, protecting identities and responding to suspicious activity. They do not replace multifactor authentication, least-privilege access, endpoint monitoring or tested offline backups. Instead, Hudson Rock's expansion gives teams another source of evidence for finding compromised credentials, interrupting C2 traffic and investigating the early stages of attacks before they become larger business incidents.