Researchers Map Dormant Infrastructure Resembling APT34 Tradecraft
Summary
An investigation links staged domains and M247 servers to APT34-like infrastructure through shared SSH keys, fabricated company websites, and a port 8080 404 response pattern, offering indicators defenders can monitor before activity begins.
Key points
- From November 2024 to April 2025, researchers tracked domains impersonating an Iraqi academic organization and fictitious UK technology firms.
- The infrastructure used M247-hosted servers, reused an SSH fingerprint, and served a port 8080 page titled “Document” with a 404 response.
- Subdomains such as mail, webmail, and cpanel suggested preparation for possible credential collection or webmail impersonation; no active payload was observed.
- Several .eu domains used fabricated company identities and shared patterns in registration, nameservers, and TLS certificates.
- The article provides HuntSQL queries and indicators for finding matching HTTP responses and SSH fingerprints.
- The final server was still reachable when the article was written; the organization whose name was impersonated was not shown to have been directly targeted.
Article Details
- Attack Vectors
- Staged infrastructure impersonated an academic organization in Iraq and fictitious UK-based technology firms.
- Subdomains including mail, webmail, cpanel, and cpcontacts suggest possible preparation for credential collection or webmail impersonation; the article reports no active payload delivery.
- Servers returned a static 404 response titled "Document" on port 8080, which the article says may obscure command-and-control activity.
- Defensive Notes
- Monitor for reuse of SSH fingerprint 05ce787de86117596a65fff0bab767df2846d6b7fa782b605daeff70a6332eb0 across IPs and hosting providers.
- Hunt for port 8080 responses with the title "Document", a 404 Not Found body, and Content-Length 338.
- Track domains registered through P.D.R. Solutions (US) LLC that use regway[.]com nameservers, and look for similar random-looking .eu domains and fabricated company branding.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | axoryvexity[.]eu | Domain in the IOC table associated with the suspicious infrastructure cluster. |
| DOMAIN | biam-iraq[.]org | Staged domain impersonating an academic organization; resolved to infrastructure exhibiting suspicious server behavior. |
| DOMAIN | plenoryvantyx[.]eu | Domain in the IOC table associated with the suspicious infrastructure cluster. |
| DOMAIN | plenoryventyx[.]eu | Domain described as hosting fabricated Sphere Spark branding associated with the infrastructure cluster. |
| DOMAIN | valtorynexon[.]eu | Domain in the IOC table associated with the suspicious infrastructure cluster. |
| DOMAIN | valtryventyx[.]eu | Domain in the IOC table associated with the suspicious infrastructure cluster. |
| DOMAIN | zyverantova[.]eu | Domain associated with fabricated company branding and the suspicious infrastructure cluster. |
| HOSTNAME | cpanel[.]biam-iraq[.]org | Subdomain observed in passive DNS under the suspicious staged domain. |
| HOSTNAME | cpcalendars[.]biam-iraq[.]org | Subdomain listed in the IOC table under the suspicious staged domain. |
| HOSTNAME | cpcontacts[.]biam-iraq[.]org | Subdomain listed in the IOC table under the suspicious staged domain. |
| HOSTNAME | mail[.]biam-iraq[.]org | Subdomain observed in passive DNS under the suspicious staged domain. |
| HOSTNAME | webdisk[.]biam-iraq[.]org | Subdomain listed in the IOC table under the suspicious staged domain. |
| HOSTNAME | webmail[.]biam-iraq[.]org | Subdomain observed in passive DNS under the suspicious staged domain. |
| IPV4 | 38[.]180[.]140[.]30 | Staging server for biam-iraq[.]org; returned the reported port 8080 decoy 404 response. |
| IPV4 | 38[.]180[.]18[.]173 | M247 server listed in the IOC table as associated with the suspicious infrastructure cluster. |
| IPV4 | 38[.]180[.]18[.]18 | M247 server listed in the IOC table as associated with the suspicious infrastructure cluster. |
| IPV4 | 38[.]180[.]18[.]189 | M247 server associated with the staged domain and reused SSH fingerprint. |
| IPV4 | 38[.]180[.]18[.]249 | M247 server listed in the IOC table as associated with the suspicious infrastructure cluster. |
| IPV4 | 38[.]180[.]18[.]253 | M247 server listed in the IOC table as associated with the suspicious infrastructure cluster. |
| SHA256 | 05ce787de86117596a65fff0bab767df2846d6b7fa782b605daeff70a6332eb0 | SSH fingerprint reported as reused across five M247 servers associated with the infrastructure cluster. |
| SHA256 | ce25b9d48b7f04ae2c1c3d729c10f41c4d5d2e7c260ad6d5446e3cc5e9f61281 | RSA SHA-256 fingerprint used in the article's query to identify other IPs exposing the same SSH key. |