Certificate and Redirect Clues Reveal Earth Baxia and PlugX Infrastructure
Summary
Researchers identified two distinct malicious infrastructure clusters using unusual TLS certificates and HTTP redirects: one linked to Earth Baxia and another potentially connected to PlugX.
Key points
- A cluster of 12 likely malicious servers was attributed to Earth Baxia based on Cloudflare and purported Microsoft certificates, domains, and HTTP 301 redirects.
- Earth Baxia-linked servers redirected users to legitimate sites, including government and defense-related websites, potentially helping obscure malicious activity.
- A separate set of five IP addresses was identified through certificates with “AES” in the organizational-unit field and a shared JA4X fingerprint.
- Four of the five servers had ports already identified by Hunt as PlugX-related; the article describes the cluster as potentially linked to PlugX operations.
- The suspected PlugX servers returned HTTP 302 redirects to Google, with unusual response formatting such as a lowercase “ok” status phrase and uppercase “LOCATION” header.
- The two infrastructure clusters were tracked independently, and the article provides IP, domain, certificate, redirect, and observation-date details for further investigation.
Article Details
- Attack Vectors
- Earth Baxia-linked servers used HTTP 301 redirects on ports 443 and 8443 to legitimate websites, apparently to make malicious activity resemble benign traffic.
- Servers potentially linked to PlugX operations used anomalous certificates containing “AES” and HTTP 302 redirects on ports 80 and 8088 to Google.
- Defensive Notes
- Monitor certificate characteristics, including unexpected Subject Alternative Name domains, self-signed certificates falsely claiming Microsoft issuance, and certificate Organizational Unit values containing “AES.”
- Hunt for unusual HTTP redirect behavior, including custom response headers and redirects observed on ports 443, 8443, 80, and 8088.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 51xiatian[.]cc | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | api[.]promociin[.]com | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | api[.]s2[.]baxtool[.]ru | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | app[.]51xiatian[.]cc | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | bing[.]com | Common Name on a self-signed certificate falsely claiming Microsoft issuance, observed on an Earth Baxia-linked server. |
| DOMAIN | index[.]caihongyun[.]cc | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | islot[.]ink | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | kallpod-asia[.]kallfly[.]com | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | naver-info[.]store | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | oca[.]pics | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | promociin[.]com | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | s3-microsoft[.]com | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | s3bucket-azure[.]online | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | skt-info[.]online | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | taipeilivecenter[.]online | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | transfer-server[.]store | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | trendmicrotech[.]com | SAN domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | viet-tel[.]site | SAN domain on a suspicious certificate associated with the Earth Baxia-linked server cluster. |
| DOMAIN | visualstudio-microsoft[.]com | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | www[.]jdf[.]mil[.]jm | Redirect destination listed for an Earth Baxia-linked malicious server. |
| DOMAIN | www[.]mi6[.]gov[.]uk | Redirect destination listed for an Earth Baxia-linked malicious server. |
| DOMAIN | www[.]mil[.]ru | Redirect destination listed for an Earth Baxia-linked malicious server. |
| DOMAIN | www[.]pao[.]af[.]mil | Redirect destination listed for an Earth Baxia-linked malicious server. |
| DOMAIN | www[.]sap[.]com | Redirect destination listed for an Earth Baxia-linked malicious server. |
| DOMAIN | www[.]youke2[.]top | Domain listed for an Earth Baxia-linked malicious server. |
| DOMAIN | xhq[.]yidaplays[.]ink | SAN domain listed for an Earth Baxia-linked malicious server. |
| IPV4 | 103[.]199[.]16[.]232 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 128[.]199[.]126[.]48 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 172[.]93[.]189[.]206 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 172[.]93[.]189[.]209 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 18[.]162[.]111[.]155 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 203[.]25[.]119[.]28 | Server hosting suspicious certificates in the Earth Baxia-linked cluster. |
| IPV4 | 203[.]55[.]176[.]207 | Earth Baxia-linked server hosting a redirect to www[.]jdf.mil[.]jm. |
| IPV4 | 38[.]54[.]85[.]112 | Server with ports detected as PlugX on the Hunt platform and included in the suspicious certificate cluster. |
| IPV4 | 43[.]239[.]249[.]243 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 45[.]133[.]239[.]188 | Server identified in the PlugX-linked certificate cluster and observed serving a custom HTTP 302 redirect. |
| IPV4 | 45[.]153[.]129[.]96 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 45[.]251[.]243[.]210 | Server with a port detected as PlugX on the Hunt platform and included in the suspicious certificate cluster. |
| IPV4 | 45[.]76[.]153[.]76 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 96[.]43[.]101[.]248 | Server identified in the PlugX-linked suspicious certificate cluster. |
| IPV4 | 96[.]9[.]212[.]181 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| IPV4 | 96[.]9[.]213[.]142 | Server listed in the Earth Baxia malicious-infrastructure observables. |
| URL | hxxps[:]//www[.]dropbox[.]com | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]ebay[.]com | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]fbi[.]gov | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]google[.]com | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]jdf[.]mil[.]jm | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]mi6[.]gov[.]uk | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]mil[.]ru | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]pao[.]af[.]mil | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]sap[.]com | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]ups[.]com | Redirect destination listed for an Earth Baxia-linked malicious server. |
| URL | hxxps[:]//www[.]wikipedia[.]org | Redirect destination listed for an Earth Baxia-linked malicious server. |
Threat Actors
Malware
Tools
RedGuardAttackers often leverage open-source redirector tools such as RedGuard or RedWarden to obscure the actual location of command-and-control (C2) servers and evade detection by researchers. However, in this case, there wasRedWardenAttackers often leverage open-source redirector tools such as RedGuard or RedWarden to obscure the actual location of command-and-control (C2) servers and evade detection by researchers. However, in this case, there was
Industries
DefenseThe selection of the redirect URLs used appears strategic, focusing on high-profile organizations in the defense, intelligence, and software sectors. These choices suggest that the attacker(s) aimed to blend intointelligenceof the redirect URLs used appears strategic, focusing on high-profile organizations in the defense, intelligence, and software sectors. These choices suggest that the attacker(s) aimed to blend into environmentsSoftwareURLs used appears strategic, focusing on high-profile organizations in the defense, intelligence, and software sectors. These choices suggest that the attacker(s) aimed to blend into environments where military or