PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 2)

blog.viettelcybersecurity.com | blog | #apt | #c2 | #cdn | #lotus-blossom | #domain-fronting | #traffic-disguise
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part 2 of Viettel's Lotus Blossom series explains Domain Fronting, showing how attackers abuse CDN behavior to make C2 traffic resemble legitimate connections by mismatching TLS SNI and Host headers.
Published
Collected

Related coverage

blog · blog.viettelcybersecurity.com
Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 2)
English Part 2 of the Lotus Blossom series explains Domain Fronting: how abusing CDN behavior and mismatching TLS SNI with the Host header lets C2 traffic look like legitimate connections.
blog · blog.viettelcybersecurity.com
Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 1)
Vietnamese Part 1 overviews the Lotus Blossom APT, active in Southeast Asia since 2012, now using leaked VPN accounts, OTT-app phishing, abused IT management systems, and Domain Fronting to hide C2.
blog · blog.viettelcybersecurity.com
Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 1)
Part 1 of the English Lotus Blossom series overviews the APT active in Southeast Asia since 2012: leaked VPN accounts, OTT-app phishing, abused IT management systems, and Domain Fronting to hide C2.
blog · netspi.com
BOFScale: A CDN-Fronted Tailnet from a BOF-PE
BOFScale runs a patched Tailscale daemon as a BOF-PE inside the implant, relaying C2 over standard WebSockets so DERP and control-plane traffic blends in behind CDNs like CloudFront and Fastly.
blog · blog.viettelcybersecurity.com
Chiến dịch tấn công mới của nhóm Lotus Blossom: Kỹ thuật Domain Fronting và Lợi dụng các hệ thống quản trị tập trung (Phần 3)
Vietnamese Part 3 of Viettel's Lotus Blossom series analyzes the SignLoader malware: DLL sideloading via a Bitdefender module, anti-analysis tricks (API hashing, junk code), and payload decryption.
blog · blog.viettelcybersecurity.com
Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 3)
Part 3 of Viettel's Lotus Blossom series dissects SignLoader: DLL sideloading via a Bitdefender module, anti-analysis (junk code, exception abuse, Carbanak API hashing), and payload decryption.
Back