cyber.hendryadrian.com
Threat Research · hunt.io

Researchers Track ShadowPad Infrastructure Using Spoofed Dell Certificates

· Original article ↗

Summary

Hunt IO researchers identified 30+ servers linked to suspected ShadowPad activity using certificates spoofing Dell. Twelve exposed HTTP on port 53; researchers also noted impersonating domains and possible infrastructure clusters.

Key points

  • Researchers identified more than 30 servers linked to suspected ShadowPad activity using certificates that spoof Dell Technologies.
  • The infrastructure was associated with a yet-unidentified threat actor; the article notes ShadowPad has been used by several suspected state-linked Chinese threat groups.
  • Twelve identified servers exposed an HTTP server on port 53, an unusual configuration that researchers say could reflect targeted deployment, misconfiguration, or a separate actor.
  • Domains in the identified infrastructure appeared to impersonate Microsoft, Google, KazakhTelecom, and SuperMicro.
  • Five additional servers using ShadowPad certificates were identified with port 443 as the only reported port.
  • Researchers also observed repeated RDP certificate common names across multiple servers.
  • The analysis relied on certificate and HTTP-header patterns alongside third-party intelligence; researchers noted that malware samples and additional information were unavailable.

Article Details

Attack Vectors
  • ShadowPad infrastructure used likely for C2 communication; a subset exposed an HTTP server on port 53.
  • The servers used TLS certificates spoofing Dell and domains spoofing organizations including Microsoft, KazakhTelecom, Google, and SuperMicro.
Defensive Notes
  • The article recommends looking beyond standard HTTP headers and commonly observed TLS certificates when identifying ShadowPad infrastructure.
  • It suggests adding identified servers to network blocklists.

Indicators of compromise

TypeIndicatorContext
DOMAINapi[.]sourcedata[.]kuwannba[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINapp2[.]toggle2[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINayana[.]imiul[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINaz[.]performed12[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINbernaspos[.]comDomain listed for an IP in the possible ShadowPad port 443-only cluster.
DOMAINczs[.]superdasqe[.]meDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINfoligni[.]itDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINgoogle[.]org[.]imDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINicw[.]imiul[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINimg[.]shaduruanjian8[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINkazakhtelecom[.]zzux[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINkzb[.]performed12[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINm[.]shadurauanjian8[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINmail[.]pitikytech[.]meDomain listed for an IP in the possible ShadowPad port 443-only cluster.
DOMAINmails[.]foligni[.]itDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINmicrosoft[.]kiwi[.]nzDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINmicrosoft[.]performed12[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINmirco[.]supermirco[.]usDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINmircoo[.]supermirco[.]usDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINns[.]supermirco[.]usDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINpitikytech[.]meDomain listed for an IP in the possible ShadowPad port 443-only cluster.
DOMAINpower[.]installation77[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINshaduruanjian8[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINtime[.]afsder[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINtime[.]kkdiscover[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINturkeylahainasunset[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINupdata[.]dsqueryonline[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINupdata[.]installation77[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINupdate[.]alpha-els[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINupdate[.]imiul[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINupdate[.]imjzo[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINupdate[.]kkdiscover[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINupdate[.]micro[.]gayDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINupdate[.]performed12[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINwagodo[.]imiul[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINwait[.]imiul[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINwapaku[.]imiul[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
DOMAINwww[.]bernaspos[.]comDomain listed for an IP in the possible ShadowPad port 443-only cluster.
DOMAINwww[.]fadfar[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINwww[.]google[.]org[.]imDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINwww[.]kazakhtelecom[.]zzux[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINwww[.]microsoft[.]kiwi[.]nzDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINwww[.]shaduranjian8[.]comDomain listed for an IP in the suspected ShadowPad port 53 cluster.
DOMAINwww[.]stdhgd[.]comDomain listed for an IP among the remaining ShadowPad infrastructure.
IPV4108[.]61[.]163[.]91IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV4139[.]180[.]188[.]54IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV4139[.]84[.]168[.]128IP address listed among the remaining ShadowPad infrastructure.
IPV4146[.]70[.]92[.]137IP address listed among the remaining ShadowPad infrastructure.
IPV4149[.]28[.]135[.]145IP address identified as ShadowPad infrastructure in the possible port 443-only cluster.
IPV4185[.]81[.]114[.]45IP address identified as ShadowPad infrastructure in the possible port 443-only cluster.
IPV438[.]54[.]105[.]226IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV438[.]60[.]193[.]62IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV443[.]153[.]92[.]190IP address listed among the remaining ShadowPad infrastructure.
IPV445[.]32[.]127[.]56IP address identified as ShadowPad infrastructure in the possible port 443-only cluster.
IPV445[.]76[.]146[.]215IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV445[.]76[.]84[.]222IP address identified as ShadowPad infrastructure in the possible port 443-only cluster.
IPV447[.]242[.]52[.]22IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV447[.]243[.]60[.]4IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV447[.]254[.]251[.]168IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV45[.]34[.]176[.]152IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]210[.]134[.]47IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]210[.]168[.]192IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]210[.]174[.]168IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]210[.]221[.]119IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]210[.]74[.]92IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]217[.]0[.]193IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]217[.]107[.]25IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV48[.]217[.]84[.]192IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]217[.]96[.]167IP address identified as ShadowPad infrastructure in the possible port 443-only cluster.
IPV48[.]218[.]128[.]35IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]218[.]163[.]77IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV48[.]218[.]17[.]11IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]218[.]213[.]245IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]218[.]214[.]23IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV48[.]218[.]244[.]117IP address listed among the remaining ShadowPad infrastructure.
IPV48[.]218[.]248[.]158IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.
IPV48[.]218[.]56[.]204IP address listed among the remaining ShadowPad infrastructure.
IPV481[.]68[.]102[.]11IP address identified as ShadowPad infrastructure in the suspected port 53 cluster.

MITRE ATT&CK

T1071.001 · Web ProtocolsThe identified ShadowPad servers appear to support likely C2 communication over HTTP.T1571 · Non-Standard PortA subset of the identified servers exposed an HTTP server on port 53, an unusual port configuration for that protocol.

Malware

ShadowPadThis post will examine ShadowPad infrastructure linked to a yet-to-be-identified threat actor. What makes this activity different is a slight change in the HTTP response headers and the use of a certificate attempting

Related Articles