Cert Safari: Leveraging TLS Certificates to Hunt Evil
Proactively hunting for malicious infrastructure is a persistent puzzle for threat researchers to work and solve. It is a complex and evolving problem, made more complex (though not unmanageable) by Domain Privacy and GDPR, which obscure WHOIS information that Analysts and Researchers would otherwise use to identify trends and corroborate other observations to increase confidence in attribution of infrastructure clustering. This has forced researchers to identify other methods to proactively hunt for malicious infrastructure.
How to Leverage TLS Certificates
Assisted by an increasing body of knowledge generated by thoughtful, forward-leaning analysts working on this very problem {1-9}, the Prevailion Adversarial Counterintelligence Team (PACT) leverages TLS certificates to compensate for the investigatory vacuum left by WHOIS redactions. But, before we dive into an analytical methodology along with an example that leverages this source of information, a quick primer on how the internet works:
The push for encrypted communications over the internet, mainly due to the influence of ecommerce, made much of the day-to-day communications between a user’s computer and a website (on a domain) encrypted using the TLS (Transport Layer Security) protocol. To implement and use TLS, a website must first prove its identity by presenting a TLS certificate. The TLS certificate contains information about the website (domain) and the organization that runs and owns that domain. It is further countersigned by a trusted party (the Certificate Authority, or CA), whose sole job is to verify that the site is truly owned and operated by the entity claiming ownership.
TLS certs are intended to bind together a domain name with an organizational identity {10}. For example, the TLS cert for Wikipedia {Figure 1, below} displays the Subject Common Name (CN=*.wikipedia.org), effectively proving the web server’s legitimate right to serve any webpage from the domain (or any subdomain) ending in “wikipedia.org”. Additionally, it can serve web pages from the other domains on the cert, as agreed upon by the entity (Wikipedia) and the CA (Let’s Encrypt).
Figure 1 – Wikpedia’s TLS certificate
Armed with the understanding that TLS certificates are required for encrypted communications between a computer and a website (domain), and that IP addresses are required for network communications (but domain names are not), it stands to reason that TLS certificates must be associated with the IP addresses hosting a given domain.
Malicious actors must execute most, if not all, of the following steps to create supporting infrastructure for their operations {7}:
Each of these steps provides an opportunity for the researcher to identify tactics or artifacts that can be used to cluster adversary activity or infrastructure. This methodology was recently used by the PACT to uncover what appears to be a cluster of unattributed activity that has yet to be reported on, hosted mainly on Vietnamese infrastructure and using domain names with a technology and cryptocurrency theme.
The PACT initially identified a blacklisted certificate, listed as a generic “Malware C&C,” on the SSL certificate blacklist (SSLBL) provided by the amazing folks at ABUSE.ch {11}. Analysts identified the cert on Censys.io by its SHA1 fingerprint, where it was associated with “google247[.]xyz” {Figure 2 below}
Figure 2 – the blacklisted certificate from SSLBL
To identify the hosting infrastructure, analysts used DomainTools’ WHOIS tool to query the domain associated with the certificate. Two notable facts were identified:
Figure 3 – WHOIS info for the domain associated with the blacklisted certificate
Analysts also noted the following additional facts for future pivots:
Identifying the hosting address of the domain enabled a pivot to Shodan {Figures 4,5, below}, which identified an additional domain associated with that IP: sellview[.]xyz.
Figure 4,5 – Results of Shodan query for the host, identifying it by IP and TLS certificate
Censys was used to backstop the findings from Shodan, positively identifying both the IP and the certificate seen on the target IP in Shodan {Figures 6,7, below}:
Figure 6 – IP corroboration from Censys
Figure 7 – Certificate corroboration from Censys
The certificate structure for sellview[.]xyz is similar in structure to the original certificate for google247[.]xyz (from the SSLBL): the “Issuer DN” string is identical; validity period is 1 year, and the “Names” values are identically structured. There are now two domains with overlapping certificate characteristics being hosted on IP 14.241.72[.]25. Additional similarities can be seen within the WHOIS registration data: the registrant information was identical (Registrant Organization: Nguyễn Quang Thuỷ; Registrar: Mat Bao Corporation, and nameservers). Screenshots of both domains using URLSCAN.io also proved to be identical: a blank white screen with “Hello.” written in black text in the top-left corner {Figure 8}.
Figure 8 – Screenshot of the two domains
The matching WHOIS registration data, along with the identical certificate structure, hosting infrastructure, and URLSCAN website screenshots, indicate it is highly likely this activity can be clustered.
Next, PACT pivoted on the IP in an attempt to identify additional domains that might be clustered with the observed activity. Querying the IP using passive DNS and domain intelligence tools corroborated the hosting of the previously identified domains as well as dozens of other domains registered under the *.xyz TLD.
Some were immediately notable due to their similarity in name or theme:
Others appeared to target a Vietnamese-speaking audience:
*translation provided using Google Translate
The shared theme of the domains (technology, cryptocurrency, re-use of numbering schemes [e.g., btc247, gold247, guess247] and the consistent use of the “.xyz” TLD), as well as the shared hosting infrastructure (IP 14.241.72[.]25), along with the overlapping WHOIS data, is used to loosely cluster this activity.
All domains listed above (22 in total) share the following characteristics:
Additional Analysis
In keeping with the subject of this post, certificate analysis on all 22 domains continued strengthening the case for clustering this activity. 20 of the 22 domains have overlapping certificate characteristics: they were previously registered with 90-day certificates from Certificate Authority “ZeroSSL”, and 13 have a current 12-month certificate from Certificate Authority Sectigo. The Sectigo certificates share a common naming schema for the website/domain in the Common Name (CN) and Subject Alternative Names (SAN) as well as the ‘Issuer DN’ string “C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA”. Both the Sectigo and ZeroSSL certificates share the same naming schema in the CN and SAN fields.
Certificate histories were available for some of the domains as far back as 2016, which also revealed that this actor has been using multiple certificate authorities (Sectigo/Comodo, ZeroSSL, Let’s Encrypt). Expired certificates for some domains also revealed additional domains (via entries in the CN or SAN fields), but these domains were not included in the findings as historical hosting data was not available. It appears from certificate timestamps that the actor was using the ZeroSSL certs in early 2021, then recertified their domains using Sectigo as the ZeroSSL certs began expiring. The most recent certifications have a period of validity beginning on 08 July 2021 (for both btc360[.]xyz and btc247[.]xyz), indicating that the actor is actively maintaining this infrastructure. The expired ZeroSSL certs are timestamped largely from early 2021, with most valid beginning dates clustered in March 2021. Certificate histories could be identified as far back as 2016 for a few select domains, but the actor appears to have begun building out the current cluster of infrastructure in mid-2020 (June/July).
In order to visualize current and potential connections, the indicators were loaded into VirusTotal Graph. VT Graph enabled analysts to further pivot on malicious samples downloaded from and communicating with the domains and hosting infrastructure, as well as identify URLs and sub-domains clustered with the identified domains.
Further analysis of the malware hosted within these domains reinforces the interconnectedness of the network. The identified samples relied heavily on scripting and LOLbins to establish persistence in the victim machine and communicate with the threat actor. Additional payloads and scripts were retrieved from btc247[.]xyz. Communication was made via SMTP from btc247[@]sellview[.]xyz to 247@sellview[.]xyz leveraging a mailserver at emailserver[.]vn, a large Vietnamese webmail provider. {Figure 9,10}
Figure 9 – Network traffic generated by infection
Figure 10 – SMTP communication from victim machine
The email attachment contains information from the victim machine indicating if it has a configuration file for TeamViewer or a specific cryptominer. Samples of this cryptominer were found in an open directory on one of the domains in this network. AeroAdmin is installed for remote control of the victim machine, but we were unable to link the AeroAdmin account back to any specific group or actor at this time.
Conclusion
Redaction of registration data previously available via WHOIS has left Threat Researchers and Threat Intel Analysts with a gap that can be bridged by investigation and clustering of TLS Certificates to identify adversary infrastructure. Thanks to the push for Certificate Transparency{12,13}, each CA continuously updates a permanent, append-only record of all certificates that have been associated to domains, which can then be leveraged to identify hosting infrastructure (and even adversary TTPs) by searching the data provided by the good folks doing the public service of scanning the internet {14}. Researchers hunting malicious infrastructure can continue to ply their trade while society grapples with GDPR and privacy law.
Notes on Analytical Gaps:
REFERENCES:
A member of the FCC renewed urgency calls on Apple and Google to remove TikTok from their app stores, raising concerns that TikTok’s Chinese-based parent company is collecting user data that is being accessed in China.
What Wicked Webs We Un-weave: Wizard Spider once again proving it isn’t you, it isn’t me; we search for things that you can’t see Authored by: Matt Stafford and Sherman Smith Executive summary: In late January 2022, Prevailion’s Adversarial Counterintelligence Team (PACT) identified extensive phishing activity designed to harvest credentials for Naver. Naver is a […]
