cyber.hendryadrian.com
Threat Research · hunt.io

TLS Certificate Analysis Links Cyberhaven Extension Attack to Long-Running Infrastructure

· Original article ↗

Summary

Researchers traced TLS certificate overlaps from the Cyberhaven Chrome extension compromise to 19 servers and domains with activity dating to early 2024. The infrastructure suggests a longer-running campaign, but links to Savvy Seahorse remain unconfirmed.

Key points

  • A phishing attack against a Cyberhaven employee led to stolen credentials being used to publish malicious Chrome extension version 24.10.4, which could steal cookies and session data.
  • The compromised extension was available for about 24 hours and communicated with two identified command-and-control IPs and related domains.
  • TLS certificate history and certificate-based pivots linked 19 servers to the infrastructure; 18 were hosted by Vultr on The Constant Company network.
  • Historical domain patterns indicate activity dating back to early 2024 and suggest the infrastructure may have supported multiple operations and targets.
  • The researchers found overlaps with activity associated with Facebook advertising account targeting, but attribution to Savvy Seahorse is not confirmed.

Article Details

Attack Vectors
  • A phishing attack targeting a Cyberhaven employee led to stolen credentials being used to publish malicious version 24.10.4 of the Cyberhaven Chrome extension on the Chrome Web Store.
  • The compromised extension could exfiltrate cookies and session data from targeted websites.
  • The article reports command-and-control servers and associated infrastructure linked through shared TLS certificates and recurring domain patterns.
Defensive Notes
  • Review Cyberhaven's preliminary analysis and indicators associated with the compromised extension version 24.10.4.
  • Hunt's certificate-IP pivoting and HuntSQL can be used to identify IPs and ports associated with the reported TLS certificate hash.
  • The article cautions that a definitive link to Savvy Seahorse has not been established.

Indicators of compromise

TypeIndicatorContext
DOMAINadmin[.]tkv2[.]proCertificate common name associated with the reported threat infrastructure.
DOMAINadmin[.]www333[.]onlineDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINadskiper[.]netDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINaiforgemini[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINapi[.]bonuspg77[.]onlineDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINapi[.]cyberhaven[.]proDomain identified by Cyberhaven as command-and-control infrastructure involved in the compromise.
DOMAINapp[.]adskiper[.]netDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINauth-wisp-systems[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINbardaiforchrome[.]liveDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINblockadsonyt[.]vipDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINblockforads[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINbo[.]jackblack[.]ioDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINchatgpt[.]forassistant[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINchatgptextent[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINchatgptforsearch[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINcheck[.]aethir[.]usDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINcheckpolicy[.]siteDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINcyberhavenext[.]proDomain identified by Cyberhaven as command-and-control infrastructure involved in the compromise.
DOMAINdearflip[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINdemo-3[.]wildwestgaming[.]netDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINdev[.]jackblack[.]ioDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINext[.]bardaiforchrome[.]liveDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINextensionbuysell[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINextensionpolicyprivacy[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINfadblock[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINgeminiaigg[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINgeminiforads[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINgoodenhancerblocker[.]siteDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINgoogle[.]forbarai[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINgpt4summary[.]inkDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINgptdetector[.]liveDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINhb333[.]onlineDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINinternetdownloadmanager[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINlinewizeconnect[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINlocallyext[.]inkDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINmassdevelopment[.]us[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINmoonsif[.]storeReported by Secure Annex and associated in the article with the malicious activity.
DOMAINokta-onslove[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINp50[.]oldrosethisrosesaidthedoctorwasgiventomefiftyfiveyearsagobysyl[.]shopDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINpieadblock[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINplutonile[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINpolicyextension[.]infoDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINproxyswitchyomega[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsavechatgpt[.]siteDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsavegptforchrome[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsavegptforyou[.]liveDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsavgptforchrome[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsearch[.]forbarai[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsearchaiassitant[.]infoDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsearchcopilot[.]coDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINsearchgptchat[.]infoDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINstagingx[.]plutonile[.]comDomain listed on a server sharing a TLS certificate with reported threat infrastructure.
DOMAINtinamind[.]infoDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINultrablock[.]proDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINvafera[.]rubrically[.]euDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINvidnozflex[.]liveDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwakelet[.]inkDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwareinnovator[.]merseine[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwildwestgaming[.]netDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwww[.]bonuspg77[.]onlineDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwww[.]checker[.]aethir[.]usDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwww[.]remiwantnun[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINwww[.]www333[.]onlineDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINyeowauto[.]skygst[.]netDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINyoutubeadsblocker[.]liveDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINytadblocker[.]comDomain listed on a server identified as part of the reported threat infrastructure.
DOMAINzhgift[.]comDomain listed on a server identified as part of the reported threat infrastructure.
IPV4108[.]181[.]190[.]53Server listed among infrastructure linked to the reported TLS certificate.
IPV4108[.]61[.]23[.]192Server listed among infrastructure linked to the reported TLS certificate.
IPV4128[.]199[.]112[.]98Server listed among infrastructure linked to the reported TLS certificate.
IPV4136[.]244[.]113[.]231Server listed among infrastructure linked to the reported TLS certificate.
IPV4136[.]244[.]115[.]219Server listed among infrastructure linked to the reported TLS certificate.
IPV4137[.]220[.]48[.]214Server listed among infrastructure linked to the reported TLS certificate.
IPV4140[.]82[.]45[.]42Server listed among infrastructure linked to the reported TLS certificate.
IPV4140[.]82[.]50[.]201Server listed among infrastructure linked to the reported TLS certificate.
IPV4144[.]202[.]123[.]86Server listed among infrastructure linked to the reported TLS certificate.
IPV4149[.]248[.]2[.]160Described by Cyberhaven as a command-and-control server involved in the compromise.
IPV4149[.]248[.]44[.]88Server listed among infrastructure linked to the reported TLS certificate.
IPV4149[.]28[.]117[.]236Server listed among infrastructure linked to the reported TLS certificate.
IPV4149[.]28[.]124[.]84Described by Cyberhaven as a command-and-control server involved in the compromise.
IPV4149[.]28[.]71[.]39Server listed among infrastructure linked to the reported TLS certificate.
IPV4155[.]138[.]253[.]165Server listed among infrastructure linked to the reported TLS certificate.
IPV445[.]32[.]231[.]212Server listed among infrastructure linked to the reported TLS certificate.
IPV445[.]32[.]69[.]11Server listed among infrastructure linked to the reported TLS certificate.
IPV445[.]76[.]225[.]148Server sharing a TLS certificate with reported threat infrastructure.
IPV445[.]77[.]5[.]196Server listed among infrastructure linked to the reported TLS certificate.
IPV480[.]240[.]21[.]36Server listed among infrastructure linked to the reported TLS certificate.

MITRE ATT&CK

T1078 · Valid AccountsThe attacker used stolen credentials to publish a malicious extension version.T1539 · Steal Web Session CookieThe compromised extension could exfiltrate cookies and session data from targeted websites.T1566 · PhishingThe article describes a phishing attack targeting a Cyberhaven employee; it does not specify the phishing delivery method.

Threat Actors

Savvy SeahorseInfoblox's tracked group is cited as a possible similarity; the article says further analysis is needed to establish a definitive link.

Vendors

CyberhavenIn late December 2024, a phishing attack targeting an employee of Cyberhaven led to the compromise of their Google Chrome extension. Cyberhaven's preliminary analysis details how the attacker used stolen credentials toDigitalOcean, LLC128.199.112[.]98 SG DigitalOcean, LLC yeowauto.skygst[.]netPsychz Networksto the previously discussed TLS record, 18 were hosted by Vultr on The Constant Company ASN, while Psychz Networks hosted one. Geographically, most of the infrastructure was based in the United States, with a smallerThe Constant Company, LLCUsing Hunt to analyze these IPs, we determined both servers are hosted on The Constant Company, LLC network, with geolocations in the United States. Additionally, the "Domains" tab within Hunt's overview page surfacedVultrOf the 19 IPs linked to the previously discussed TLS record, 18 were hosted by Vultr on The Constant Company ASN, while Psychz Networks hosted one. Geographically, most of the infrastructure was based in the United

Products

Chrome Web Storedetails how the attacker used stolen credentials to publish a malicious version, 24.10.4, on the Chrome Web Store. Active for approximately 24 hours, the compromised extension could exfiltrate cookies and sessionCyberhaven Chrome extensionOur findings highlight the breadth and longevity of the infrastructure tied to the Cyberhaven Chrome extension compromise. By pivoting on a TLS record, we identified 18 servers heavily relying on Vultr. TheGoogle Chrome2024, a phishing attack targeting an employee of Cyberhaven led to the compromise of their Google Chrome extension. Cyberhaven's preliminary analysis details how the attacker used stolen credentials to publish

Tools

HuntUsing Hunt to analyze these IPs, we determined both servers are hosted on The Constant Company, LLC network, with geolocations in the United States. Additionally, the "Domains" tab within Hunt's overview page surfacedHuntSQL

Countries

FranceGermanySingaporethe infrastructure was based in the United States, with a smaller presence in Europe and one server in Singapore. All observed IPs associated with the record were configured to use HTTP port 443.United Stateswe determined both servers are hosted on The Constant Company, LLC network, with geolocations in the United States. Additionally, the "Domains" tab within Hunt's overview page surfaced several indicators of compromise

Related Articles