Merlin: The HTTP/2 C2 That Russian Operators Turned on Ukraine

Merlin is an open-source, cross-platform post-exploitation command-and-control framework written in Go, notable as one of the first C2s to use HTTP/2 for agent communications and later adding HTTP/3. Its legitimate purpose is adversary emulation and red-team operations. Unlike many dual-use tools it has confirmed real-world abuse: CERT-UA attributed an August 2023 campaign against Ukrainian state agencies — actor UAC-0154 — to deployment of the Merlin agent. Its Go codebase yields a single static cross-platform binary, and its protocol flexibility plus TLS-fingerprint evasion make it a meaningful detection challenge.

Overview

Merlin was introduced in December 2017 by Russel Van Tuyl (“Ne0nd0g”), associated with SpecterOps, and its current major line is version two. The server and agent are written in Go and distributed through the Go package ecosystem and a Docker image.

Capabilities

• Agent C2 over HTTP/1.1, HTTP/1.1 over TLS, HTTP/2, clear-text HTTP/2 (h2c) and HTTP/3 over QUIC. T1071.001
• JA3 evasion: the agent can present a TLS ClientHello matching an operator-supplied JA3 hash, explicitly to defeat detections keyed to a tool’s known fingerprint. T1001
• Encrypted agent traffic (JWE) with configurable transforms (AES, RC4, XOR, Base64, hex) and message padding to defeat fixed-size beacon detection. T1573.001
• Domain fronting, in-process .NET assembly execution and shellcode injection. T1090.004 T1055

Real-World Abuse: UAC-0154

MITRE ATT&CK Mapping

Detection & Mitigation

• Alert on HTTP/2 or HTTP/3 (QUIC) C2 to non-reputable hosts from endpoints that otherwise speak HTTP/1.1, and on clear-text h2c to internet hosts; consider restricting outbound QUIC where not needed.
• Do not rely on a single JA3 signature — Merlin can spoof it; prefer timing and jitter plus destination-reputation analytics, since padding defeats size heuristics.
• Block CHM attachments and restrict hh.exe via attack-surface-reduction; enable PowerShell logging and monitor legitimate file hosts used for staging.