JustJoin-Themed Landing Page Resurfaces on Infrastructure Linked to TA444/BlueNoroff
Summary
Hunt researchers found a JustJoin-themed landing page on infrastructure linked to previously reported TA444/BlueNoroff activity. Related servers shared an SSH fingerprint, suggesting coordinated infrastructure management.
Key points
- A server at 23.254.167[.]216 hosted a JustJoin landing page, a theme previously associated with TA444/BlueNoroff activity.
- Two domains resolving to the server were linked to previous reporting; two additional domains had no established connection to the group.
- Two other Hostwinds servers shared the original server’s SSH fingerprint, suggesting possible coordination.
- One related server exposed SSH, HTTP, and email-related services; researchers said these could support impersonation or phishing, but did not confirm malicious use.
- Hunt recommends monitoring suspicious lookalike domains and HTML hashes, and considering proactive blocking of associated IPs.
Article Details
- Attack Vectors
- The article says TA444/BlueNoroff uses spoofed domains themed around virtual meeting platforms such as Zoom to support phishing campaigns and malware delivery.
- The server at 23.254.167[.]216 hosted a 'JustJoin' landing page on port 80, a theme the article links to prior reporting on the group.
- Two additional servers shared an SSH fingerprint with the initial server, suggesting potential coordination; the article says email-related ports on one server may indicate impersonation of legitimate email services or support phishing operations.
- Defensive Notes
- Monitor for suspicious domains mimicking legitimate services, especially services relevant to an organization's users.
- Monitor HTML hashes associated with malicious web pages and consider proactively blocking associated IPs within networks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | a0info[.]v6[.]army | Domain serving the 'JustJoin' landing page and associated with previous reporting on the activity. |
| DOMAIN | make-hex-32332e3235342e3136372e323136-rr[.]1u[.]ms | Domain serving the 'JustJoin' landing page and associated with previous reporting on the activity. |
| IPV4 | 108[.]174[.]194[.]196 | Server linked to the initial server by a shared SSH fingerprint and described as part of the suspicious network artifacts. |
| IPV4 | 108[.]174[.]194[.]44 | Server linked to the initial server by a shared SSH fingerprint; the article reports no other notable findings. |
| IPV4 | 23[.]254[.]167[.]216 | Server hosting the 'JustJoin' landing page associated with the reported activity. |
Threat Actors
Vendors
HostwindsFor hosting, TA444 primarily uses virtual private servers (VPS) from various providers, with Hostwinds being the most frequently observed in our analysis at Hunt. Operational security (OPSEC) lapses have revealedNamecheapby Hostwinds. The remaining domains, though leading to blank web pages, are registered through NameCheap. While these domains are not overtly malicious, their association with the identified network artifacts
Products
Countries
Industries
CryptocurrencyThe group often registers domains that mimic legitimate businesses, particularly in the cryptocurrency and fintech sectors, leveraging these deceptive names to support phishing campaigns and malwarefintechgroup often registers domains that mimic legitimate businesses, particularly in the cryptocurrency and fintech sectors, leveraging these deceptive names to support phishing campaigns and malware delivery.