Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Suspected KEYPLUG Infrastructure: TLS Certificates and GhostWolf Links

hunt.io | blog | #threat-intelligence | #apt41 | #tls-certificates | #keyplug | #redgolf | #infrastructure-tracking

Summary

Hunt.io pivots on wolfSSL certificates from prior KEYPLUG reporting to surface renewed RedGolf/APT41-linked infrastructure, noting a WolfSSL update has since blunted the 'Support_1024' fingerprint.
Published
Collected

original ↗

Related coverage

blog · hunt.io
KeyPlug Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company
A KeyPlug-linked server exposed for under 24 hours revealed Fortinet exploit scripts, an AES/XOR-capable PHP webshell, and reconnaissance against Shiseido's enterprise infrastructure.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia
Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
back