Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cyberhaven Extension Compromise: TLS Certificates Reveal Hidden Infrastructure

hunt.io | blog | #supply-chain | #browser-extension | #tls-certificates | #ssl-history | #cyberhaven | #savvy-seahorse

Summary

Hunt.io uses SSL history to tie a certificate to the Cyberhaven extension compromise, connecting its C2 servers to a wider campaign against Facebook ad accounts via fast-rotating Let's Encrypt certs.
Published
Collected

original ↗

Related coverage

blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
blog · hunt.io
Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Starting from a Joker-flagged 4K wallpaper APK, SSL certificate history pivots map the Android malware's C2 network across Alibaba Cloud servers and uncover related domains.
blog · hunt.io
LightSpy Malware Now Targets Facebook & Instagram Data
A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.
blog · hunt.io
Advanced Threat Hunting with New SSL Features: Unlocking HuntSQL™ Anomaly Flags for Deeper Detection
After PupyRAT slipped past its old parser, Hunt.io adopted Google's Certificate Transparency library and added HuntSQL anomaly flags for malformed, expired, and rogue certificates.
blog · hunt.io
Suspected KEYPLUG Infrastructure: TLS Certificates and GhostWolf Links
Hunt.io pivots on wolfSSL certificates from prior KEYPLUG reporting to surface renewed RedGolf/APT41-linked infrastructure, noting a WolfSSL update has since blunted the 'Support_1024' fingerprint.
back