TLS Certificate and JA4X Clues Link New Servers to Suspected GhostWolf Infrastructure
Summary
Hunt researchers identified six active servers matching TLS certificate and JA4X indicators associated with suspected GhostWolf infrastructure, but say attribution to RedGolf/APT41 remains uncertain. A wolfSSL change also makes one certificate field unreliable for dete
Key points
- Researchers pivoted from 39 IPs in a prior GhostWolf report and identified a wolfSSL certificate with the unusual OU value “Support_1024.”
- The certificate hash and JA4X fingerprint were used to find six IP addresses, including servers with recent detections.
- Some results overlapped with nearby IPs cited in reporting on suspected APT41 activity targeting Italian organizations; the authors say they lack malware samples to confirm a direct connection.
- The researchers also found a server with a wolfSSL-style certificate and matching issue time, but could not conclusively link it to RedGolf.
- The article says “Support_1024” has since appeared in wolfSSL’s standard server.pem, so that field alone is no longer a reliable KeyPlug indicator.
- The authors recommend monitoring unusual certificate details and using TLS fingerprinting such as JA4+ to investigate suspicious infrastructure.
Article Details
- Attack Vectors
- Suspected KEYPLUG command-and-control infrastructure was observed using HTTPS over port 8443; servers also showed TLS or TCPWRAPPED responses on port 443.
- Some associated IPs hosted WebSocket or raw TCP servers during overlapping periods.
- A server in Yoroi's reporting was noted communicating over QUIC.
- Defensive Notes
- Do not rely on the Support_1024 certificate field alone: the article says it has since appeared in wolfSSL's standard server.pem file and is no longer a reliable KeyPlug indicator.
- Monitor certificates for unusual Organizational Unit values and unexpected issue dates, and use TLS fingerprinting such as JA4+ alongside other indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]146[.]230[.]130 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 103[.]146[.]230[.]165 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 103[.]146[.]230[.]183 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 103[.]226[.]155[.]96 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 103[.]226[.]155[.]98 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 103[.]234[.]96[.]167 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 103[.]244[.]148[.]80 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 108[.]61[.]159[.]145 | IP returned by the article's search for likely active GhostWolf infrastructure. |
| IPV4 | 111[.]180[.]200[.]74 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 114[.]55[.]6[.]216 | Server with a certificate and port usage the article says align with previously reported C2 infrastructure; connection to RedGolf is unconfirmed. |
| IPV4 | 13[.]124[.]47[.]148 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 13[.]209[.]204[.]54 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 13[.]214[.]160[.]122 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 13[.]214[.]172[.]25 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 13[.]214[.]203[.]53 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 13[.]228[.]200[.]171 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 13[.]250[.]182[.]175 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]180[.]145[.]193 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]180[.]153[.]109 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]180[.]188[.]174 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]180[.]189[.]81 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]180[.]211[.]30 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]180[.]213[.]58 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 139[.]84[.]175[.]197 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 149[.]28[.]130[.]130 | IP returned by the article's search for likely active GhostWolf infrastructure. |
| IPV4 | 149[.]28[.]131[.]126 | IP returned by the article's search for likely active GhostWolf infrastructure. |
| IPV4 | 15[.]168[.]60[.]114 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 154[.]12[.]87[.]168 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 154[.]31[.]217[.]200 | The article identifies port 8443 on this host as a believed HTTPS-based KEYPLUG C2 server. |
| IPV4 | 154[.]92[.]16[.]198 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 158[.]247[.]203[.]247 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 158[.]247[.]234[.]25 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 158[.]247[.]245[.]229 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 158[.]247[.]251[.]91 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 158[.]247[.]253[.]114 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 173[.]209[.]62[.]186 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 173[.]209[.]62[.]187 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 173[.]209[.]62[.]188 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 173[.]209[.]62[.]189 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 173[.]209[.]62[.]190 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 18[.]142[.]113[.]169 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 18[.]142[.]162[.]202 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 18[.]143[.]183[.]217 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 18[.]163[.]6[.]115 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 202[.]182[.]121[.]16 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 202[.]79[.]173[.]211 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 202[.]79[.]173[.]220 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 202[.]79[.]173[.]228 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 205[.]185[.]121[.]28 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 207[.]148[.]71[.]45 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 209[.]141[.]36[.]195 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 3[.]0[.]139[.]139 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 3[.]1[.]206[.]135 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 3[.]38[.]151[.]172 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 36[.]255[.]220[.]179 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 38[.]55[.]24[.]53 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 39[.]106[.]32[.]186 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 43[.]130[.]61[.]252 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 43[.]201[.]51[.]16 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 43[.]249[.]36[.]84 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]137[.]10[.]166 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]137[.]10[.]37 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]148[.]244[.]220 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]32[.]101[.]56 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]32[.]125[.]90 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]76[.]150[.]120 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 45[.]77[.]34[.]88 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 47[.]245[.]60[.]81 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 47[.]245[.]99[.]137 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 47[.]92[.]204[.]81 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 5[.]188[.]34[.]87 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 51[.]79[.]177[.]23 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 54[.]151[.]200[.]128 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 64[.]176[.]50[.]30 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 64[.]176[.]51[.]12 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 64[.]176[.]83[.]46 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]69[.]6 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]70[.]52 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]78[.]204 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]78[.]223 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]79[.]14 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]79[.]156 | IP returned by the article's search for likely active GhostWolf infrastructure. |
| IPV4 | 65[.]20[.]84[.]44 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 66[.]42[.]49[.]65 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]228[.]18 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]228[.]19 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]228[.]20 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]228[.]21 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]228[.]22 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]234[.]146 | IP reported by Yoroi as an IoC for a suspected APT41 intrusion, communicating over QUIC. |
| IPV4 | 67[.]43[.]234[.]147 | Adjacent IP associated in SSL History with the reported infrastructure. |
| IPV4 | 67[.]43[.]234[.]148 | Adjacent IP associated in SSL History with the reported infrastructure. |
| IPV4 | 67[.]43[.]234[.]149 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 67[.]43[.]234[.]150 | IP returned by the article's search for likely active GhostWolf infrastructure. |
| IPV4 | 8[.]209[.]255[.]168 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 8[.]213[.]131[.]120 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 8[.]218[.]156[.]56 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 8[.]219[.]191[.]81 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 8[.]222[.]220[.]3 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 8[.]222[.]243[.]185 | Listed as a historical network observable for the GhostWolf infrastructure. |
| IPV4 | 88[.]218[.]192[.]22 | Listed as a historical network observable for the GhostWolf infrastructure. |
| SHA256 | 4c1baa3abb774b4c649c87417acaa4396eba40e5028b43fade4c685a405cc3bf | Certificate hash associated with reported KEYPLUG infrastructure. |
Threat Actors
APT41The article identifies APT41 as another name for RedGolf.BARIUMThe article identifies BARIUM as another name for RedGolf.Earth BakuThe article identifies Earth Baku as another name for RedGolf.RedGolfTracked designation for the suspected Chinese state-sponsored actor associated with the reported KEYPLUG infrastructure; the article says attribution remains uncertain.
Malware
Products
Tools
Huntabove. which listed 39 IPs associated with the GhostWolf infrastructure. We queried each IP in the Hunt app to identify commonalities that would aid in tracking more recent servers. One key data point surfacedJA4+If you're unfamiliar with JA4X, it's part of the JA4+ fingerprinting suite and an extension of the JA3 TLS fingerprinting method], designed to create more precise fingerprints by including additional metadata. This