Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unlock SSL Intelligence: How SSL History Boosts Threat Hunting

hunt.io | blog | #threat-hunting | #tls | #ssl-certificates | #apt41 | #ssl-intelligence | #c2-infrastructure

Summary

SSL intelligence—certificate issuers, validity and reuse patterns—exposes malicious infrastructure; Hunt.io cites KeyPlug/GhostWolf and Cyberhaven cases where certificate history revealed C2 servers.
Published
Collected

original ↗

Related coverage

blog · hunt.io
KeyPlug Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company
A KeyPlug-linked server exposed for under 24 hours revealed Fortinet exploit scripts, an AES/XOR-capable PHP webshell, and reconnaissance against Shiseido's enterprise infrastructure.
blog · hunt.io
Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Starting from a Joker-flagged 4K wallpaper APK, SSL certificate history pivots map the Android malware's C2 network across Alibaba Cloud servers and uncover related domains.
blog · hunt.io
Suspected KEYPLUG Infrastructure: TLS Certificates and GhostWolf Links
Hunt.io pivots on wolfSSL certificates from prior KEYPLUG reporting to surface renewed RedGolf/APT41-linked infrastructure, noting a WolfSSL update has since blunted the 'Support_1024' fingerprint.
blog · hunt.io
Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity
Hunt.io finds Cobalt Strike 4.10 team servers carrying a rare watermark (688983459) seen on only five other IPs, with brand-impersonating domains suggesting phishing-focused operations.
blog · hunt.io
WarmCookie Infrastructure Update: Uncovering New C2 Servers and Threats
Hunt.io expands on a WarmCookie C2 server flagged by Gen Threat Labs, using certificate history, HTTP response patterns and shared SSH keys to surface additional hosts tied to the updated backdoor.
blog · hunt.io
Latrodectus Malware Masquerades as AhnLab Security Software to Infect Victims
Hunt.io dissects MeDExt.dll, a Latrodectus downloader masquerading as AhnLab security software, and pivots on its TLS certificate to uncover more C2 servers and distribution domains.
back