Certificate and Domain Patterns Reveal More Infrastructure Linked to Suspected DarkPeony Campaign

Nov 21, 2024 · Original article ↗

Summary

Hunt IO correlates SSL/TLS certificates, domains, and servers with suspected DarkPeony infrastructure, linking one domain to a PlugX-related malicious file and sharing a query to help defenders hunt for similar infrastructure.

Key points

The investigation expands on infrastructure previously associated with suspected Chinese cyber-espionage group DarkPeony and PlugX campaigns.
Researchers identified certificates and associated domains across multiple IP addresses, including recurring Cloudflare, TrustAsia, and “AES” certificate patterns.
A malicious file named “Meeting Invitation.msc” was observed communicating with vabercoach[.]com and loginge[.]com; NTT previously reported the same filename in its Operation ControlPlug coverage.
Cloudflare services can obscure the infrastructure’s underlying IP addresses and complicate tracking.
The article provides a JARM, certificate-name, and ASN query as a starting point for finding additional related infrastructure.
Hunt IO recommends using the network observables to proactively hunt for emerging infrastructure; the article reports no additional malware samples for several of the listed servers.

Article Details

Attack Vectors: The article reports suspected PlugX C2 infrastructure using recurring certificate patterns, including certificates with “AES” in the Organizational Unit field and CloudFlare-protected domains.
The file “Meeting Invitation.msc” was observed communicating with vabercoach[.]com and making calls to the domain’s endpoint/unit; the analysis also showed activity involving loginge[.]com.
Defensive Notes: Use the reported IP addresses, domains, and certificate SHA-256 values to hunt for related infrastructure.
The article provides a starting-point query for finding additional CloudFlare certificates: JARM fingerprint "2ad2ad0002ad2ad22c2ad2ad2ad703dc1bf20eb9604decefea997eabff7", Subject Common Name "CloudFlare Origin Certificate", and ASN "152194, 137443". The query could also include port 443, but the article cautions that the port may change.
The article recommends monitoring certificate and domain-registration patterns to identify emerging infrastructure before it becomes operational.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`buyinginfo[.]org`	Reported as a PlugX C2 server and used as a starting point for identifying related infrastructure.
DOMAIN	`councilofwizards[.]com`	Domain linked to a CloudFlare certificate on an IP identified as part of the suspected infrastructure.
DOMAIN	`kentscaffolders[.]com`	Domain associated with a CloudFlare certificate on an IP identified as part of the suspected infrastructure.
DOMAIN	`loginge[.]com`	Domain observed in network activity involving the malicious “Meeting Invitation.msc” file and listed as a certificate DNS name on 223.26.52[.]208.
DOMAIN	`smldatacenter[.]com`	Domain associated with a CloudFlare certificate on an IP identified as part of the suspected infrastructure.
DOMAIN	`thelocaltribe[.]com`	Domain associated with a CloudFlare certificate on an IP identified as part of the suspected infrastructure.
DOMAIN	`vabercoach[.]com`	Domain associated with suspected campaign infrastructure; the file “Meeting Invitation.msc” was observed communicating with it.
IPV4	`103[.]107[.]105[.]81`	IP linked to the reported PlugX C2 domain buyinginfo[.]org.
IPV4	`146[.]66[.]215[.]19`	IP identified as part of the suspected infrastructure and associated with councilofwizards[.]com.
IPV4	`149[.]104[.]2[.]160`	IP identified as part of the suspected infrastructure and associated with smldatacenter[.]com.
IPV4	`202[.]91[.]36[.]213`	IP identified as part of the suspected infrastructure and associated with kentscaffolders[.]com.
IPV4	`223[.]26[.]52[.]208`	IP identified as part of the suspected infrastructure; its CloudFlare certificate lists loginge[.]com as a DNS name.
IPV4	`223[.]26[.]52[.]245`	IP sharing a certificate associated with the suspected campaign infrastructure.
IPV4	`45[.]32[.]105[.]184`	IP identified as part of the suspected infrastructure and associated with thelocaltribe[.]com.
IPV4	`96[.]43[.]101[.]248`	IP associated with suspected PlugX campaign infrastructure and a certificate for vabercoach[.]com.
SHA256	`05d9d2785e08fed0bd3be97bd267cd56752381a5f032fe8d140a9a0ae54ff5d4`	CloudFlare certificate hash listed for suspected infrastructure at 45.32.105[.]184.
SHA256	`130c463ed1c2b33e88f618dc030819e3abbc0898e953428888da77eddf01c18d`	CloudFlare certificate hash listed for suspected infrastructure at 96.43.101[.]248 and 223.26.52[.]245.
SHA256	`2f35b0a119a7ca8204f4d158abcdc90163b0f19f968367c685ed3a86258c45f4`	TrustAsia certificate hash listed for suspected infrastructure at 149.104.2[.]160.
SHA256	`366e5abec0c2495720223e0438996ebff3d3596fd516e5a06d9c908c7c2057c1`	CloudFlare certificate hash listed for suspected infrastructure at 223.26.52[.]208.
SHA256	`397afb74746b2fe01abc63789412b38f44ceb234a278a04b85b2bb5b4e64cc8c`	SHA-256 of the malicious file “Meeting Invitation.msc.”
SHA256	`3bcbed98faf9c8addaedf04dbbb04d0bf457190dbc98e5548183eeeacc9d9a6d`	CloudFlare certificate hash listed for suspected infrastructure at 146.66.215[.]19.
SHA256	`6cfb62e5feae0de193b3f04b47e534a95bde79fbe3b74e582233f341c510e1dd`	TrustAsia certificate hash listed for suspected infrastructure at 223.26.52[.]208.
SHA256	`6d14946db325352cf82161b5aa1bb3442f6b980269a0cdbfedb1311dc795aef9`	CloudFlare certificate hash listed for suspected infrastructure at 202.91.36[.]213.
SHA256	`708d60b51595d2cdb313e40e9215e3857d931ac9368f308b4fc3244c75bb2f7e`	CloudFlare certificate hash listed for suspected infrastructure at 103.107.105[.]81.
SHA256	`994260498e6bdad93af7052c99cc7a894a0b9d509bcf28391399f0bbf41fb6e6`	AES certificate hash listed for suspected infrastructure at 96.43.101[.]248.
SHA256	`a0097944d47f7174231ce7a38a3c25cc51d9e9a70d5574ce04aa427ee6a3a78f`	AES certificate hash listed for suspected infrastructure at 45.32.105[.]184.
SHA256	`b9949ef3d7fed686ecaf04cc9ebebc55fb7594c94f51e9794ab7bc4bb3237cf0`	AES certificate hash listed for suspected infrastructure at 146.66.215[.]19.
SHA256	`d64c9aaa5447427aa5deb13ff80ff1d73b8c074f1666ab452a80e0bd45825ced`	TrustAsia certificate hash listed for suspected infrastructure at 103.107.105[.]81.
SHA256	`eeb4ae9acc598de874257a70941edda377c9ef45e7f3059c8c5d28778f87dd5b`	CloudFlare certificate hash listed for suspected infrastructure at 149.104.2[.]160.
SHA256	`f888da96249aea874229554a433ee3e5ab2483d400ef10c20fda4118149f45b8`	TrustAsia certificate hash listed for suspected infrastructure at 202.91.36[.]213.