Researchers Link Sliver C2 Infrastructure to Possible Y Combinator Targeting
Summary
Hunt IO linked two Sliver C2 servers and Ligolo-ng tunneling infrastructure through shared TLS certificates and port configurations, and found a spoofed Y Combinator-like domain and a Sliver implant. The intended target remains uncertain.
Key points
- Hunt IO identified 179.60.149[.]75 hosting Sliver C2 services and Ligolo-ng, alongside the lookalike domain ycombinator.serveblog[.]net, which redirects to Y Combinator’s legitimate site.
- A malicious ELF file named "cloud" communicated with the server; 31 VirusTotal vendors identified it as a Sliver implant.
- The implant’s observed HTTP request paths included /data/bundles, /data/javascripts, and /data/authenticate; attempts to access them returned 404 responses.
- TLS certificate analysis linked a second server, 179.60.149[.]4, to the first; both had similar Sliver and Ligolo-ng port configurations.
- The researchers said the infrastructure and spoofed domain suggest possible targeting of Y Combinator, but reported no further leads confirming the operators’ objective.
Article Details
- Attack Vectors
- Sliver C2 infrastructure was observed on 179.60.149[.]75 and 179.60.149[.]4, with Ligolo-ng also present on both servers.
- The domain ycombinator.serveblog[.]net mimicked Y Combinator and redirected visitors to its legitimate website; the article describes this as a possible attempt to establish trust or deflect suspicion.
- A file named cloud, identified by 31 VirusTotal vendors as a Sliver implant, communicated with the subject IP. VirusTotal showed requests for /data/bundles, /data/javascripts, and /data/authenticate.
- Defensive Notes
- Monitor changes in known malicious infrastructure indicators, including TLS certificates and port configurations, to identify potentially linked servers.
- The article identifies Sliver-related certificate patterns including the common names “multiplayer” and “localhost”; it notes that certificates may also contain random words or fictitious organization names.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ycombinator[.]serveblog[.]net | Spoofed domain associated with the Sliver C2 infrastructure; it redirected visitors to Y Combinator’s legitimate website. |
| IPV4 | 179[.]60[.]149[.]4 | Identified as an additional Sliver C2 server with Ligolo-ng present; it shared a TLS certificate with 179.60.149[.]75. |
| IPV4 | 179[.]60[.]149[.]75 | Identified as a Sliver C2 server with Ligolo-ng present. |
| SHA256 | 252a651b3bbab4f3b84c2e8ee9a37c3e899094cfd7366c814c1eae1632da2668 | SHA-256 hash of a TLS certificate used to pivot to the additional Sliver C2 server. |
| SHA256 | c8b524ca90adea19d920beb5cc6bd86dd03b23b0b2c61675cef9d6c0446aea84 | SHA-256 hash of the file named cloud, identified by 31 VirusTotal vendors as a Sliver implant. |