Threat-Intelligence Pivots Uncover New Infrastructure Linked to SmartApeSG Campaign
Summary
A case study shows how analysts used Validin data and PacketWatch WireSight telemetry to investigate a fake software update campaign, pivot across infrastructure, identify dozens of potential indicators, and search client traffic for matches.
Key points
- WireSight threat-feed alerts flagged outbound traffic to cpajoliette[.]com, associated with the LandUpdate808 fake software update campaign.
- The domain had previously hosted a malicious JavaScript file that redirected to a ClickFix loader linked to SmartApeSG.
- Analysts used Validin DNS, host-connection, metadata, body-hash, and favicon pivots to identify dozens of related domains and IP addresses.
- The infrastructure included recently registered .top domains, with several sharing hosting and site metadata.
- A search of the client’s packet-capture sessions found a match for the newly identified indicators; further investigation was needed to determine whether the attack succeeded.
- The indicators were added to custom WireSight Signals to automatically flag future matches.
Article Details
- Defense Focus
- Integrate threat intelligence with network-session monitoring and infrastructure pivoting to detect campaign activity, investigate related indicators, and hunt for prior or future connections.
- Detection Methods
- Query sessions for outbound connections flagged as threats, excluding the IP Tracking Domains category to reduce false positives.
- Enrich suspicious IP addresses and domains with reputation, passive DNS, WHOIS, resolution, and host-connection data.
- Pivot across shared HTML body SHA1 hashes, HOST-META values, favicon hashes, and linked domains to identify related infrastructure.
- Search full packet-capture session data for the identified campaign domains and IP addresses.
- Review endpoint logs around suspicious visits for cmd.exe or PowerShell commands and processes launched or created during that timeframe.
- Data Sources
- WireSight session records and full packet capture
- Validin Threat Feed and Lens Tool enrichment
- Validin passive DNS, WHOIS, reputation, resolution, and Host Connections data
- HTML page source and JavaScript resources
- Endpoint logs
- Maltrail IOC listing
- SANS ISC report
- Rule Types
- WireSight search queries using threat, network.direction, threat.indicator.name, host, and IP fields
- Platforms
- PacketWatch WireSight
- Validin
- Irix
- Defensive Actions
- Add the discovered indicators to custom WireSight Signals for automatic alerting on future matches.
- Search historical session data for connections to the identified domains and IP addresses, then investigate whether the activity succeeded.
- Investigate suspicious endpoint activity around the time of a matching connection, including command execution and process creation.
- Correlate indicators with enrichment and infrastructure pivots rather than relying on an IP reputation label alone.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | alabastervoyage[.]top | Domain included in the WireSight hunt query for the campaign's identified infrastructure. |
| DOMAIN | ambercompanion[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | ambergallery[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | bronzewhisper[.]top | Domain serving the ClickFix loader JavaScript and identified as campaign infrastructure. |
| DOMAIN | cedarlanternhub[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | cobaltmeadow[.]top | Domain listed among potential campaign IOCs discovered through Validin pivots. |
| DOMAIN | copperhorizon[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | coralmanor[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | coralregistry[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | cpajoliette[.]com | Domain associated with the LandUpdate808 fake software update campaign; the article says it was compromised and previously hosted malicious JavaScript. |
| DOMAIN | crimsonterrace[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | granitequill[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | hazelcanvas[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | ivorycompass[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | ivorycourtyard[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | jadepassagehub[.]top | Domain listed among potential campaign IOCs discovered through Validin pivots. |
| DOMAIN | marblebeacon[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | openmeadowlab[.]top | Domain listed among potential campaign IOCs discovered through Validin pivots. |
| DOMAIN | saffronjunction[.]top | Domain identified by the favicon-hash pivot and listed as a campaign IOC. |
| DOMAIN | sharpfield[.]top | Domain identified as malicious under the ZPHP label and suggested by Validin to be associated with the same campaign. |
| DOMAIN | silvercourier[.]top | Domain identified by the HTML body hash pivot and listed as a campaign IOC. |
| DOMAIN | silverfolio[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| DOMAIN | silvertrailhub[.]top | Domain identified by the HTML body hash pivot and listed as a campaign IOC. |
| DOMAIN | stoneharvest[.]top | Domain identified through infrastructure pivots and listed as a campaign IOC. |
| IPV4 | 104[.]36[.]229[.]207 | IP identified during a pivot and listed as a campaign IOC. |
| IPV4 | 178[.]156[.]128[.]5 | IP identified during a HOST-META pivot and listed as a campaign IOC. |
| IPV4 | 178[.]156[.]219[.]224 | Campaign-related hosting IP identified through infrastructure pivots. |
| IPV4 | 5[.]161[.]124[.]201 | IP listed as a campaign IOC for threat hunting. |
| IPV4 | 5[.]161[.]248[.]121 | IP identified during a pivot and listed as a campaign IOC. |
| IPV4 | 5[.]78[.]196[.]236 | IP listed as a campaign IOC for threat hunting. |
| IPV4 | 87[.]99[.]143[.]230 | IP listed as a campaign IOC for threat hunting. |
| IPV4 | 87[.]99[.]148[.]129 | IP listed as a campaign IOC for threat hunting. |
| IPV4 | 87[.]99[.]159[.]241 | IP listed as a campaign IOC for threat hunting. |
| MD5 | e3a46f20be728d46dac88ec757345713 | Favicon hash used to identify an additional campaign-related domain. |
| SHA1 | c06768826d06adfea5f86c63fcb01c21c8d67e0f | SHA1 hash of the HTML body associated with sharpfield[.]top, used to pivot to related domains. |
Malware
Vendors
PacketWatchSee how PacketWatch integrates Validin threat intelligence to investigate malicious traffic, uncover related infrastructure, and expand threat hunts in WireSight.ValidinSee how PacketWatch integrates Validin threat intelligence to investigate malicious traffic, uncover related infrastructure, and expand threat hunts in WireSight.
Products
IrixThese newly identified IOCs are added to custom WireSight Signals in Irix, enabling automatic WireSights for future matches.Validin Threat FeedThis integration includes the Validin Threat Feed, which WireSight checks against every single session for signs of malicious traffic.WireSightSee how PacketWatch integrates Validin threat intelligence to investigate malicious traffic, uncover related infrastructure, and expand threat hunts in WireSight.