Hunt Finds More Than 400 Exposed Viper Servers and Maps Related C2 Tools
Summary
Hunt tracked over 400 internet-exposed Viper login pages and found many hosted in China on Tencent infrastructure. Its scanning also linked Viper deployments with Cobalt Strike, Sliver, and Yakit.
Key points
- Hunt tracked more than 400 unique IP addresses hosting Viper login pages, many of which were exposed to the internet.
- Most observed Viper servers were in China; over half of the infrastructure was hosted on Tencent, commonly on port 60000.
- Viper login-page headers, page content, its default TLS certificate, and a favicon hash can help identify deployments.
- Hunt observed Viper infrastructure alongside Cobalt Strike, including servers associated with suspected spoofing domains such as www.microsoftupdate[.]fun.
- The researchers also found Viper paired with Sliver and Yakit, and used Yakit certificate details to pivot to additional infrastructure.
- The article notes that Yakit is a legitimate security tool, but threat actors can use it alongside exploitation platforms.
Article Details
- Attack Vectors
- Viper provides modules for stages including initial access, privilege escalation, lateral movement, and data collection, and supports payload generation for Windows, Linux, and MacOS.
- The article reports Viper instances paired with Cobalt Strike, Sliver, and Yakit on internet-accessible servers.
- Some observed domains were described as likely spoofing Microsoft update services or imitating an AI model website associated with TSMC.
- Defensive Notes
- Researchers can identify Viper login pages using HTTP response characteristics, including a 200 response, content length 692, the title "VIPER," and the default certificate subject common name d1d38ec9.
- The article gives the Viper favicon SHA1 f3d6b54a151c34b4931dc5a5a997afe96225569d as a detection clue, while noting it can be removed from the code.
- The default Viper port observed was 60000; the article recommends varying port numbers when developing detection rules.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | model[.]tsmcai[.]com | Domain hosted on the reported server and described as likely imitating an AI model website for TSMC. |
| DOMAIN | www[.]microsoftupdate[.]fun | Domain resolving to the reported Viper/Cobalt Strike server and described as likely spoofing Microsoft update services. |
| IPV4 | 111[.]231[.]146[.]154 | IP reported to host Viper and a leaked Cobalt Strike version 9 Team Server. |
| IPV4 | 124[.]71[.]84[.]65 | Huawei IP reported to host a leaked Cobalt Strike instance and Sliver. |
| IPV4 | 162[.]14[.]69[.]252 | Tencent-hosted IP reported to have a Cobalt Strike Team Server with the same watermark as another observed server; its domains were described as spoofing a flash drive app. |
| IPV4 | 185[.]230[.]228[.]136 | IP reported to host Viper and Yakit MITM and TeamServer certificates. |
| IPV4 | 185[.]230[.]228[.]140 | IP identified through a Yakit certificate pivot and reported to run Viper on its default port. |
| IPV4 | 43[.]139[.]67[.]72 | Tencent-hosted server reported to host Viper and two Cobalt Strike instances; it resolves to a domain described as likely spoofing Microsoft update services. |
| IPV4 | 8[.]210[.]32[.]15 | Alibaba Cloud IP reported to host mitmproxy and resolve to a domain described as likely imitating an AI model website for TSMC. |
Vendors
Alibaba Cloudby the red bug symbol) and ViperThe final domain we'll examine is model.tsmcai[.]com, hosted by Alibaba Cloud and resolving to 8.210.32[.]15. This domain is likely attempting to imitate an AI model website forHuaweiat Viper & Cobalt Strike IPFigure 10: Leaked certificate for Cobalt StrikeMoving on, we'll look at Huawei IP address 124.71.84[.]65, which once again hosts a leaked version of Cobalt Strike (indicated by theTencentour scanning efforts indicate that over half of the Viper infrastructure observed by Hunt is hosted on Tencent's servers, predominantly utilizing the default port of 60000. This detail not only underscores the
Tools
Cobalt StrikeIn this post, we'll look at Viper's widespread use across countries and ASNs, detail some approaches to detecting its login pages, and discuss other tools used alongside Viper, such as Cobalt Strike, Sliver, and Yakit.mitmproxyAlso found on port 28888 of the same IP is the open-source interactive HTTPS proxy, mitmproxy.NucleiSome features of Yakit include MITM, web fuzzing, vulnerability scanning, subdomain crawling, and integration with Project Discovery's Nuclei tool.SliverIn this post, we'll look at Viper's widespread use across countries and ASNs, detail some approaches to detecting its login pages, and discuss other tools used alongside Viper, such as Cobalt Strike, Sliver, and Yakit.Viperinitial access and privilege escalation to lateral movement and data collection, the open-source platform Viper boasts over 80 modules designed to streamline the stages of an attack, making it a preferred tool for redYak LangTSMC on 8.210.32[.]15Touted as a replacement for BurpSuite, the team at Yaklang.io has developed Yak Lang, a language tailored for the cybersecurity community. Users can integrate various security tools andYakitIn this post, we'll look at Viper's widespread use across countries and ASNs, detail some approaches to detecting its login pages, and discuss other tools used alongside Viper, such as Cobalt Strike, Sliver, and Yakit.