cyber.hendryadrian.com
Threat Research · hunt.io

Researchers Map SolarMarker Infrastructure and Find Shared SSH Keys Across 100+ Servers

· Original article ↗

Summary

Hunt researchers identified 20 suspected SolarMarker servers and found a shared SSH key on more than 100 servers. Their analysis also surfaced hosting patterns, other services, and domains suspected of impersonating financial providers.

Key points

  • Researchers identified 20 servers they believe are associated with SolarMarker, mostly matching the malware's tier 1 infrastructure pattern, including port 80.
  • Most identified servers were hosted on M247 networks, across several European locations and subsidiaries.
  • One suspected SolarMarker server used port 443 and a TLS certificate naming barekaz[.]com.
  • A shared SSH key found on one server was also present on more than 100 others.
  • Some servers associated with that key hosted Sliver; one also hosted Raccoon Stealer in early 2023.
  • Researchers found domains suspected of impersonating Interac and Egyptian payments provider Fawry; the domains returned 404 errors.

Article Details

Attack Vectors
  • SolarMarker infected devices communicate with its infrastructure through HTTP POST requests on port 80; tier 1 servers relay victim data to higher-tier servers.
  • SolarMarker is described as capable of executing commands through a backdoor and using hVNC.
  • The article identifies likely phishing or spoofing domains impersonating Interac and Fawry.

Indicators of compromise

TypeIndicatorContext
DOMAINgrvnews[.]livePreviously identified as associated with Lycantrox infrastructure; the article notes this does not establish a link between Lycantrox and SolarMarker.
DOMAINinterac-financial[.]comHosted on 188.116.34_204 and described as a likely attempt to impersonate Interac.
DOMAINmail[.]myfawry[.]netHosted on 2.58.15_58 and described as likely attempting to spoof Fawry.
DOMAINmyfawry[.]netHosted on 2.58.15_58 and described as likely attempting to spoof Fawry.
DOMAINwww[.]myfawry[.]netHosted on 2.58.15_58 and described as likely attempting to spoof Fawry.

MITRE ATT&CK

T1071.001 · Web ProtocolsInfected devices communicate with SolarMarker infrastructure using HTTP POST requests over port 80.

Malware

Raccoon StealerSliver & Raccoon StealerSolarMarkerFollowing Recorded Future's (RF) report, "Exploring the Depths of SolarMarker's Multi-tiered Infrastructure," the Hunt Research Team leveraged the IOCs provided to discover a method of identifying clusters of

Vendors

M247If you track malicious infrastructure, you are likely familiar with the M247 network. This ASN accounts for the majority of our findings across SolarMarker's infrastructure. Most of the malicious servers are located in

Tools

SliverSliver & Raccoon Stealer

Countries

CanadaEgyptdomains are likely attempting to spoof Fawry, an e-payment and digital finance solutions provider in Egypt. In an ongoing theme, all three domains return a 404 error.

Industries

Financial Services

Related Articles