Researchers Map Updated WarmCookie Infrastructure and Identify Possible DarkGate C2 Overlap
Summary
Hunt.io researchers linked six servers to updated WarmCookie activity using certificate and HTTP-response similarities. A shared SSH key exposed a wider set of servers, including one flagged as a possible DarkGate C2.
Key points
- The investigation began with IP 38.180.91[.]117, reported as a WarmCookie command-and-control server.
- Researchers used certificate attributes and HTTP response patterns to identify six additional servers potentially linked to updated WarmCookie.
- They cross-referenced the infrastructure with public sources, including VirusTotal and ThreatFox; some servers had been active from late September.
- One identified server shared an SSH key with 24 other servers, though the authors noted this could reflect a shared or leaked server configuration.
- One server in the SSH-key-associated infrastructure was flagged as a DarkGate C2 and had two recent files communicating with it.
- The researchers published network indicators but withheld their full detection query while continuing to monitor the activity.
Article Details
- Attack Vectors
- A FakeUpdate campaign used compromised websites to deliver the WarmCookie backdoor.
- WarmCookie command-and-control infrastructure was identified through shared certificate attributes and HTTP response patterns.
- Servers sharing an SSH key were investigated as potential related infrastructure; the article notes this could also result from a shared or leaked preconfigured server image.
- Defensive Notes
- Review the listed WarmCookie-associated IP addresses and linked domains for potential malicious activity.
- Treat the SSH-key associations as leads for investigation rather than confirmation that every associated server is part of WarmCookie infrastructure.
- Monitor the updated WarmCookie infrastructure and investigate potential overlap with DarkGate.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | abrushofchange[.]org | Reverse-DNS domain listed for a server in the SSH-key-associated infrastructure list. |
| DOMAIN | adbs[.]info[.]tntseminars[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | adbs[.]info[.]ultimacomputers[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | dedicated[.]vsys[.]host | Reverse-DNS domain listed for a server in the SSH-key-associated infrastructure list. |
| DOMAIN | dig-authentic[.]ipq[.]co | Domain linked to a server in the list of SSH-key-associated potential WarmCookie-related infrastructure. |
| DOMAIN | duplified[.]com[.]co | Reverse-DNS domain listed for a server in the SSH-key-associated infrastructure list. |
| DOMAIN | mx1[.]info[.]tntseminars[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | mx1[.]info[.]toelicking[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | mx1[.]info[.]ukshowroom[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | mx1[.]info[.]ultimacomputers[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | mx5[.]mailer[.]reasonablish[.]com | Domain linked in the article's list of servers sharing an SSH key associated with potential WarmCookie-related infrastructure. |
| DOMAIN | rrfqm[.]site | Reverse-DNS domain listed for a server in the SSH-key-associated infrastructure list. |
| DOMAIN | savemo[.]shop | Reverse-DNS domain listed for a server in the SSH-key-associated infrastructure list. |
| IPV4 | 176[.]97[.]124[.]149 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 176[.]97[.]124[.]203 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 178[.]209[.]52[.]166 | Additional server identified as sharing characteristics with the reported WarmCookie C2. |
| IPV4 | 185[.]161[.]251[.]26 | Additional server identified as sharing characteristics with the reported WarmCookie C2. |
| IPV4 | 185[.]254[.]198[.]219 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 185[.]49[.]68[.]139 | Additional server identified as sharing characteristics with the reported WarmCookie C2. |
| IPV4 | 194[.]71[.]107[.]41 | Additional server identified as sharing characteristics with the reported WarmCookie C2. |
| IPV4 | 194[.]87[.]45[.]138 | Additional server identified as sharing characteristics with the reported WarmCookie C2. |
| IPV4 | 195[.]66[.]213[.]111 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 195[.]66[.]213[.]160 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 195[.]66[.]213[.]243 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 31[.]42[.]177[.]38 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 38[.]180[.]91[.]117 | Reported by Gen Threat Labs as a WarmCookie C2 server. |
| IPV4 | 45[.]11[.]59[.]207 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]11[.]59[.]230 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]11[.]59[.]231 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]173[.]21 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]173[.]22 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]134 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]135 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]136 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]137 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]18 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]245 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]254 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 45[.]134[.]174[.]73 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 91[.]205[.]2[.]219 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 91[.]222[.]173[.]140 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 91[.]222[.]173[.]245 | Server listed as sharing the SSH key associated with potential WarmCookie-related infrastructure. |
| IPV4 | 91[.]222[.]173[.]91 | Server identified as sharing an SSH key with other potentially WarmCookie-related infrastructure. |
Malware
DarkGatethe above table, 91.222.173[.]140, hosted within the SOLLUTIUM EU Sp z.o.o. ASN, has been flagged as a DarkGate C2 server with two recent files--Notepad++.exe and upd_1602649.msix--actively communicating with the IP.WarmCookieTwitter), highlighting a new wave of a FakeUpdate campaign using compromised websites to deliver the WarmCookie backdoor. Of note, an updated version of the backdoor adding capabilities was identified, accompanied
Tools
Countries
BG194.71.107[.]41 EDIS GmbH BGCH178.209.52[.]166 Nine Internet Solutions AG CH 2024-10-03DE185.49.68[.]139 Leaseweb Deutschland GmbH DE 2024-09-23ES194.87.45[.]138 GLOBAL INTERNET SOLUTIONS LLC ESUnited Statesany linked domains for defenders to comb through. If you come across something interesting (we did!) let us know.