How IOC Pivoting Can Reveal Links Across Threat Actor Infrastructure

Summary

Hunt.io demonstrates how analysts can pivot from threat actor profiles and IOCs to connected infrastructure, using host details, DNS, SSH keys, network signals, and historical activity to investigate possible campaign links.

Key points

Hunt.io's threat actor profiles connect actors with sourced indicators, aliases, campaigns, IPs, hosts, and file hashes.
Filters for actor, victim, country, and incident type help analysts narrow indicators to relevant investigations.
The walkthrough traces IP 185.220.100.240 through hosting details, low-reputation hostnames, and a shared SSH key fingerprint with nearby Tor exit nodes.
The IP's activity included scans across 36 ports, varied HTTP requests and user agents, and multiple TLS fingerprints—patterns the article says may indicate automated reconnaissance or early-stage attack infrastructure.
Historical SSH and JARM activity, plus a certificate linked to a suspicious domain, provide additional context for assessing infrastructure reuse.
The article presents IOC pivoting as a way to explore connected hosts and hashes and identify potential links across campaigns.

Article Details

Topic: Threat actor intelligence and IOC pivoting for identifying and investigating suspicious infrastructure

Indicators of compromise

Type	Indicator	Context
DOMAIN	`098909hjk[.]casacam[.]net`	Low-reputation hostname linked to the suspicious infrastructure at 185.220.100.240.
DOMAIN	`mkw[.]vitekivpddns[.]com`	Low-reputation hostname linked to the suspicious infrastructure at 185.220.100.240.
DOMAIN	`vhjry71[.]accesscam[.]org`	Low-reputation hostname linked to the suspicious infrastructure at 185.220.100.240.
DOMAIN	`www[.]xdka2l66crf4ehum[.]net`	Suspicious domain associated with a certificate on the host; described as potentially disposable or attacker-controlled.
IPV4	`185[.]220[.]100[.]240`	Host associated with suspicious scanning behavior and possible early-stage attack infrastructure.