Researchers Identify Fresh Infrastructure Linked to the Oyster Backdoor
Summary
Hunt IO identified three IPs and associated domains linked to Oyster backdoor activity, using TLS and web-page fingerprints to track infrastructure. Shared SSH keys connected one IP to 20 others, though the links do not prove malicious intent.
Key points
- Hunt IO reported three IP addresses recently observed as part of infrastructure it associates with the Oyster backdoor.
- The IP 193.109.120[.]240 resolves to cloudignitetech[.]com and hosts a page titled “Soon,” a pattern previously used to track Oyster infrastructure.
- Researchers used a JARM fingerprint and a Let's Encrypt certificate to help identify related infrastructure.
- Scans linked two of the reported IPs to domains also identified by TRAC as associated with Vanilla Tempest.
- A shared SSH-key fingerprint linked 185.196.10[.]179 to 20 other IPs, many in the same ASN.
- The researchers caution that shared keys may reflect misconfiguration, reused server images, or a leaked key, and do not conclusively establish malicious activity.
- Oyster, also known as Broomstick and CleanUpLoader, is a backdoor that collects host details and communicates with command-and-control servers over TLS.
Article Details
- Attack Vectors
- Oyster establishes C2 communication through HTTP POST requests, typically to endpoints beginning with /api, and transfers encoded HTTP data over TLS.
- A June 2024 malvertising campaign reportedly used trojanized installers for Google Chrome and Microsoft Teams to deliver Oyster.
- Defensive Notes
- Hunt IO reports that a web page displaying “Soon” and a JARM fingerprint were useful for identifying associated infrastructure.
- Hunt IO cautions that servers associated through shared SSH keys may reflect misconfiguration, shared images, or reuse of a leaked key, and do not conclusively indicate malicious intent.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudignitetech[.]com | Domain associated with an IP tracked by Hunt IO as Oyster backdoor infrastructure. |
| DOMAIN | futurepathlabs[.]com | Domain listed as resolving to an IP tracked by Hunt IO as Oyster backdoor infrastructure. |
| DOMAIN | greensolutionshub[.]net | Domain listed as resolving to an IP tracked by Hunt IO as Oyster backdoor infrastructure. |
| DOMAIN | kisppy[.]net | Domain listed as resolving to an IP tracked by Hunt IO as Oyster backdoor infrastructure. |
| IPV4 | 185[.]196[.]10[.]179 | IP address tracked by Hunt IO as Oyster backdoor infrastructure; the article assesses that it resolves to futurepathlabs[.]com and kisppy[.]net. |
| IPV4 | 193[.]109[.]120[.]240 | IP address tracked by Hunt IO as Oyster backdoor infrastructure; the article identifies cloudignitetech[.]com as its associated domain. |
| IPV4 | 91[.]236[.]230[.]11 | IP address tracked by Hunt IO as Oyster backdoor infrastructure; the article assesses that it resolves to greensolutionshub[.]net. |
MITRE ATT&CK
Threat Actors
ITG23The article says Insikt Group linked CleanUpLoader, described as a variant of Oyster, to ITG23.RhysidaNamed as a threat actor linked to the Oyster backdoor.Vanilla TempestThe article says TRAC linked two IP addresses and three domains to Vanilla Tempest; Hunt IO reports overlap between that infrastructure and infrastructure it associates with Oyster.Vice SocietyNamed as a threat actor linked to the Oyster backdoor.
Malware
BroomstickAlso known as Broomstick and CleanUpLoader, Oyster first appeared in July 2023. The backdoor collects host details and communicates with its command-and-control (C2) server via TLS, using encoded HTTP data to transferCleanUpLoaderAlso known as Broomstick and CleanUpLoader, Oyster first appeared in July 2023. The backdoor collects host details and communicates with its command-and-control (C2) server via TLS, using encoded HTTP data to transferOysterAfter a period of dormancy, the Oyster backdoor--linked to threat actors such as Vanilla Tempest, Vice Society, and Rhysida-has recently resurfaced. Over the past week, our continuous monitoring efforts have uncovered a
Vendors
BlueVPS OUcontext, we shift our focus to a third IP, 193.109.120[.]240, and its associated domain. Hosted on the BlueVPS OU network, this server has ports 80 and 443 open for HTTP/S and port 56777 configured for SSH, as shownGlobal-Data System IT CorporationShared Hosting: One of the IPs revealed connections to 20 additional servers sharing SSH keys, all belonging to the Global-Data System IT Corporation ASN.Let's EncryptRegistration Patterns: Most domains are registered through NameCheap, and Let's Encrypt TLS certificates are used to protect communications.NamecheapRegistration Patterns: Most domains are registered through NameCheap, and Let's Encrypt TLS certificates are used to protect communications.
Products
Google ChromeIn June 2024, Rapid7 identified a malvertising campaign leveraging trojanized installers for popular software like Google Chrome and Microsoft Teams to deliver the Oyster backdoor.Microsoft TeamsIn June 2024, Rapid7 identified a malvertising campaign leveraging trojanized installers for popular software like Google Chrome and Microsoft Teams to deliver the Oyster backdoor.
Countries
DE185.196.10[.]182 DE Global-Data System IT Corporation lido.fi-nft[.]app Shared SSH keys w/ 185.196.10[.]179 + belowEE193.109.120[.]240 EE BlueVPS OU cloudignitetech[.]com Detected by HuntUnited Kingdom185.196.10[.]179 UK Global-Data System IT Corporation futurepathlabs[.]comUnited States91.236.230[.]11 US BlueVPS OU greensolutionshub[.]net Detected by Hunt