CYBERTHREATANALYSIS

By Insikt Group®
May 3, 2022

SOLARDEFLECTION C2Infrastructure Usedby NOBELIUM in Company
Brand Misuse

CYBER THREAT ANALYSISKey Judgments• Insikt Group is confident that the identified
SOLARDEFLECTION infrastructure can be attributed tothe threat activity group publicly reported as NOBELIUM;
this confidence is based on the use of overlapping
network infrastructure previously attributed to NOBELIUM
in public reporting, as well as unique variations of Cobalt
Strike traditionally used by the group.
This report profiles the unique infrastructure used by Russian statesponsored threat activity group NOBELIUM. The activity was identified througha combination of large-scale automated network traffic analytics and analysis
derived from open source reporting. Data sources include the Recorded Future
Platform, SecurityTrails, DomainTools, PolySwarm, Farsight, Shodan, Censys, Team
Cymru’s Pure Signal™ and other common open-source tools and techniques. The
report will be of most interest to individuals engaged in strategic and operational
intelligence relating to the activities of the Russian government in cyberspace andnetwork defenders. Some technical details from our original research have notbeen included in this report version in order to protect tracking techniques andongoing research into NOBELIUM activity.

Executive Summary• Broader themes in SOLARDEFLECTION C2 typosquats
have included the misuse of brands across multiple
industry verticals, particularly in the news and media
industries.
• Cobalt Strike servers related to SOLARDEFLECTION
monitoring that were also previously linked to NOBELIUM
activity used modified server configurations, likely in an
attempt to remain undetected from researchers actively
scanning for standard Cobalt Strike server features.
• NOBELIUM has made extensive use of typosquatdomains in SSL certificates and will likely continue to use
deceptive techniques, including typosquat redirection,
when using Cobalt Strike tooling.

Recorded Future’s Insikt Group continues to monitor
Russian state-sponsored cyber espionage operations targetinggovernment and private sector organizations across multiple
geographic regions. From mid-2021 onwards, Recorded Future’s Backgroundmidpoint collection revealed a steady rise in the use of NOBELIUM
Analysis of recent and historical domains attributed toinfrastructure tracked by Insikt Group as SOLARDEFLECTION,NOBELIUM
broadly demonstrates the group’s familiarity with, andwhich encompasses command and control (C2) infrastructure.
tendencytoemulate, a variety of media, news and technology
In this report, we highlight trends observed by Insikt Group while
monitoring SOLARDEFLECTION infrastructure and the recurring providers. The group has abused dynamic DNS resolution to
construct and resolve to randomly generated subdomains foruse of typosquat domains by its operators.
its C2s or root domains to mislead victims. The key aspect
A key factor we have observed from NOBELIUM operators to these attacks is the use of either email addresses or URLs
involved in threat activity is a reliance on domains that emulate that look similar to the domain of a legitimate organization.
other brands (some legitimate and some that are likely fictitious Potentially harmful domain registrations and typosquats canbusinesses). Domain registrations and typosquats can enable enable spearphishing campaigns or redirects that pose anspearphishing campaigns or redirects that pose a threat to victim elevated risk to a company’s brand or employees. A successful
networks and brands.
spearphish is dependent on factors such as the quality of theUsing a combination of proactive adversary infrastructure message, the credibility of the sender address, and, in the casedetections, domain analysis techniques, and Recorded Future of a redirecting URL, the credibility of the domain name. Insikt
Network Traffic Analysis, we have determined that NOBELIUM’s Group has previously observed other Russian nexus groups using
use of SOLARDEFLECTION infrastructure overlaps with other typosquatting in support of operations, such as those aimed
common infrastructure tactics, techniques, and procedures at the 2020 presidential elections, to increase confidence in(TTPs) previously attributed to the group by multiple the validity of the fraudulent login portal used to harvest victim
organizations including Microsoft, Fortinet, Sekoia, and Volexity. credentials. This tactic has also been reported recently inPrevious open source reporting also highlighted NOBELIUM’s use open sources in connection with intrusions targeting entities inof cracked versions of the Cobalt Strike penetration testing tool. Ukraine, likely in support of Russia’s invasion of the country.

1

CTA-2022-0503

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 1: SOLARDEFLECTION Domain Registration reference in the Recorded Future Platform (Source: Recorded Future)

The Recorded Future Platform automatically detects
Insikt Group assesses that NOBELIUM is a threat activity
group operating in line with the objectives of Russia’s Foreign typosquatted domains; each newly created domain entity isIntelligence Service (SVR). The SVR is tasked with providing the evaluated for typosquatting-style similarity to other domains
president of the Russian Federation, the Federal Assembly, and observed by Recorded Future. An example of this is thethe government with the intelligence they need to make decisions SOLARDEFLECTION typosquat displayed in Figure 1, whichin the areas of politics, the economy, military strategy, scientific- based on the domain’s spelling was very likely an attempt bytechnical strategy, and the environment. Russia’s SVR defines NOBELIUM operators to emulate the T-Mobile brand. A review
itself as separate by allowing the Russian Main Intelligence of the frequency in which SOLARDEFLECTION domains were
Directorate (GRU) to focus on military intelligence operations, registered over the past two years confirmed NOBELIUM’s
while the SVR focuses on political intelligence; this is, however, tendency to register domains in cycles, occasionally taking shorta very high-level view of these operations. The SVR conducts hiatuses which at times likely coincided with new open source
its affairs by collecting information via public and private means, reporting attributing several domains to NOBELIUM activity (aswith the intended goal of gathering strategic information from depicted within the Recorded Future timeline below).
organizations and individuals who in turn influence strategic
Insikt Group proactively detects SOL ARDEFLECTION
policy and decision-makers in targeted countries.
infrastructure through an in-depth understanding of the
In 2021, Volexity published research outlining a suspected infrastructure TTPs that the group employs (detailed further
APT29 phishing operation that targeted non-governmental below within the Infrastructure TTPs section). Additionally, theorganizations (NGOs), research institutions, governments, Command and Control data set enables us to enrich and identify
and international bodies using election fraud-themed lures any SOLARDEFLECTION IPs that we have categorized as “positive
purporting to be sent from the United States Agency for C2”. We then analyze network communications to investigate
International Development (USAID), a government agency. how the C2 is interacting with infected machines or how it is
The same day, Microsoft also published research on wider being administered by the adversary. SOLARDEFLECTION C2s
TTPs used in the same campaign and attributed the activity to can be reviewed from within the Recorded Future Platform’s
NOBELIUM, the group behind the SolarWinds intrusions. This Command and Control data set.
campaign targeted sensitive diplomatic and government entities
as early as February 2021. They believe the threat actor used
Threat Analysis
this information to launch other highly targeted attacks as partof their broader campaign. Additional research confirmed that
SOLARDEFLECTION Overview
a cluster of infrastructure monitored by Insikt Group under thedesignation SOLARDEFLECTION since 2021 overlaps with thisNOBELIUM employs a wide range of bespoke toolingprevious reporting. Ongoing detections within the Recorded developed in a variety of programming languages, demonstrating
Future Command and Control security feed assisted in confirming a substantial research and development effort in support of
the registration of new typosquat domains tied to NOBELIUM its cyber operations. The threat group also makes good use
operations. More notably, we have confirmed that several newly of publicly available commodity tools such as Cobalt Strike toidentified typosquats continue to adopt the naming conventions hinder attribution efforts. NOBELIUM exhibits highly developedor themes that were originally flagged as likely being associated operational security practices in its tradecraft, aimed atwith NOBELIUM reporting as early as 2020.
disrupting researchers’ efforts in associating their malware andinfrastructure to the group. Using a combination of proactive
C2 detections, domain analysis, and network traffic analysis,
we have determined that SOLARDEFLECTION servers sharecommon infrastructure TTPs, enabling us to confidently cluster
and attribute these servers to NOBELIUM.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0503

2

CYBER THREAT ANALYSIS

Figure 2: SOLARDEFLECTION Typosquat Registration Timeline (Source: Recorded Future Data)

Using current DNS records and passive DNS sources,
we resolved IPs for newly registered domains tracked as
LUNARREFLECTION
SOLARDEFLECTION since January 2022 and reviewed SSL
While developing our original detection logic for
certificate information associated with these IPs. As a result,
we discovered several domains via SOLARDEFLECTION tracking SOL ARDEFLECTION, we observed a secondary cluster of(see Appendix A) and a continued trend of using both Namesilo infrastructure that deviated technically from the main cluster.
and Namecheap for domain registration. The reason behind the However, it contained domains bearing similarities to those usedpreference for these registrars is unknown; all domains collected within SOLARDEFLECTION, and we believe this cluster is also likely
under SOLARDEFLECTION had domain privacy options enabled. managed by NOBELIUM operators. The similarities include theuse of registrars Namecheap and Namesilo and domain themes
Analysis of the domains covered under SOLARDEFLECTION
that overlap with those identified within SOLARDEFLECTION
highlighted a trend around the use of themed domains, primarily
domain registrations. Recorded Future tracks this secondary
emulating entities within the media and news industry, as wellcluster under the name LUNARREFLECTION. An aggregation of
as a smaller nexus around business development-themed
discovered LUNARREFLECTION C2s is provided in Appendix A.
domains. Both of these themes have been documented in open
As seen in the industry breakdown in Figure 4 below, there issource reporting in connection with known NOBELIUM activity.
The reason behind these theme choices is not fully understood a similar trend among LUNARREFLECTION domains that emulate
beyond the suspected attempt to masquerade as other brands entities within the news and media industries. However, given
the volume of SOLARDEFLECTION and LUNARREFLECTION
to appear legitimate to targets.
typosquats in these industries, it is important to emphasizethat the industry being emulated does not necessarily equate
to that industry being targeted. Domains themed around news
and media industry contacts are very likely to be used to target
entities across a wider spectrum of industries, including thosethat have been consistently of interest to NOBELIUM operators,
such as government embassies.

3

CTA-2022-0503

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 3: Breakdown of industries being emulated within SOLARDEFLECTION typosquats (Source: Recorded Future)

Figure 4: Breakdown of industries being emulated within LUNARREFLECTION typosquats (Source: Recorded Future)
www.recordedfuture.com | Recorded Future ®

CTA-2022-0503

4

CYBER THREAT ANALYSIS

Infrastructure TTPs

Activity Spotlight: Role of Cobalt Strike

Recorded Future continues to monitor NOBELIUM by distilling
vast swaths of open source and technical data and combining itwith analysts’ intimate knowledge of attacker tradecraft. Network
Traffic Analysis analytics enable users to investigate and tracksuspected targeted intrusion activity derived from validated
technical data sources. We apply a series of filters and algorithms
to spot suspicious network traffic concerning these detected
malicious servers, highlighting possible targeted intrusion
activity. Intelligence Card extensions within the Recorded Future
Platform then allow users to enrich this information further using
data from close partners such as SecurityTrails, thereby enabling
Recorded Future Threat Intelligence module users to efficiently
map out prospective adversary campaigns.

Some of the key characteristics used for SOLARDEFLECTION
and LUNARREFLECTION have been the prevalent use of specificCobalt Strike instances, including custom payload configurations,
unique SSL certificates, and the likely use of cs2modrewrite
to obfuscate C2 traffic. Cobalt Strike servers previously linked
to NOBELIUM activity used modified server configurations
to remain undetected by security researchers monitoring forstandard Cobalt Strike server features. NOBELIUM has madeextensive use of typosquat domains in SSL certificates and has
used deceptive techniques including redirection when using
Cobalt Strike tooling.

Over the course of our research, Insikt Group observed
multiple uncommon characteristics unique to NOBELIUM thatserve as distinguishable hallmarks in terms of our potential to
track this activity long term. The elements described below aresome of the trackable characteristics which have been foundto be used when investigating NOBELIUM-linked infrastructurewith the resulting derived infrastructure covered under
SOLARDEFLECTION and LUNARREFLECTION.

Analyzing infrastructure clustered under SOLARDEFLECTION
and LUNARREFLECTION revealed hallmarks that pointed to thelikely use of cs2modrewrite, a modification technique for Cobalt
Strike-based infrastructure developed by members of Threat
Express, an information security blog “created by red teamers,
penetration testers and security professionals”.
Details of the functionality of cs2modrewrite from its GitHub
repository state, “This project converts a Cobalt Strike profile toa functional mod_rewrite .htaccess or Nginx config file to support
HTTP reverse proxy redirection to a Cobalt Strike TeamServer.
The use of reverse proxies provides protection to backend
C2 servers from profiling, investigation, and general internet
background radiation”. Infrastructure linked to cs2modrewrite
instances can be set up in several different ways, including
separating the hosting of the reverse proxy server and Cobalt
Strike server, or co-hosting the reverse proxy and Cobalt Strikeon the same server.

When
analyzing
SOLARDEFLECTIONand
LUNARREFLECTION-related HTTP banner data, significant
mistakes were observed and were found to be consistentacross all related discovered infrastructure. A related trend
involves the consistent use of specifically customized SSL
certificates. Although these customizations are not unique toonly SOLARDEFLECTION and LUNARREFLECTION instanceson their own, the particular curation style of these certificatesis uncommon and is a practice found consistently across all
Of particular interest in the repository is the file “cs2nginx.
discovered infrastructure.
py”, which was last updated February 5, 2020, and whose
Also found consistently in SOL ARDEFLECTION and comment description states, “Converts Cobalt Strike profiles to
LUNARREFLECTION infrastructure is a mismatch between Nginx config file format (/etc/nginx/nginx.conf)”. The resulting
the SSL certificate Subject CN (Common Name) and the 302 Nginx configs will “Attempt to serve files locally if they exist”,
redirection location. Further investigation of the redirect location “Proxy any matching URIs to the C2 server”, and “Redirect any
domain shows that the referenced URI is a legitimate resource non-matching requests to a specified redirection domain along
for a fully functioning website; however, the Subject CN-related with the original URI”.

domain is typically found to have no significant website data
Analysis of cs2nginx functionality and comments reveals
associated with it.
options for modification to Nginx Cobalt Strike servers that match
infrastructure discovered via SOLARDEFLECTION. Insikt Groupidentified several methods of identifying network infrastructureused by NOBELIUM in their intrusion operations, based on theinformation published by Microsoft and analysis of the groups’
infrastructure TTPs such as banner data.

5

CTA-2022-0503

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 5: cs2modrewrite Redirection method (Source: Maltego)

Recurring Use of COSMICNODE

As of this publication, the COSMICNODE family continues
to use new anti-analysis, encryption, and obfuscation methods
Analysis of NOBELIUM infrastructure identified multiple
to disguise the Cobalt Strike payloads and hamper static
loader samples written using unique unpacking code used todetection of the COSMICNODE implants. NOBELIUM has used
deploy Cobalt Strike Beacons and shellcode that Insikt GroupAES encryption, byte swapping, multi-stage XOR encoding, andinternally tracks as COSMICNODE. COSMICNODE is likely another obfuscation methods, suggesting a deep understanding ofevolution of the family tracked by Sentinel One in connection
how to hinder defender efforts to detect and analyze payloads.
with NobleBaron and by Microsoft as NativeZone. Microsoft
Malleable Cobalt Strike C2 Profiles enable operators to customize
has previously stated that NativeZone encompasses multiple
the details of the command and control protocol used. The Cobalt
instances of NOBELIUM’s custom Cobalt Strike loaders, making
Strike payloads have predominantly used one of two watermarks
it an umbrella term for any variant, to include one of the several
associated with leaked builds, 1359593325 or 305419896, andnamed families detailed further below. COSMICNODE typicallythe standard jQuery malleable profile that helps traffic blend
uses rundll32.exe to load and execute follow-on payload(s).
in by mimicking legitimate services. The previously mentioned
theme around typosquats of news-related entities carried over
into both SOLARDEFLECTION and LUNARREFLECTION C2 server
URLs that contained similar strings pertaining to “news” or “info”
topics, including:• sampledomain[.]com,/news/update/aaa• sampledomain[.]com,/news_indexedimages_autrzd/
Infrastructure that did not meet the criteria for either
SOL ARDEFLECTION or LUNARREFLECTION, but matchedsignaturing for cs2modrewrite instances, which are likely to be
Cobalt Strike servers, are aggregated in Appendix A.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0503

6

CYBER THREAT ANALYSIS

Victimology

Mitigations

With the finite data available to Recorded Future surrounding
The delivery of the Cobalt Strike Beacon malware and thethis campaign, limited conclusions can be drawn regarding C2 communication (defined by the malleable C2 profile) are best
victimology. Through behavioral profiling of network traffic to detected using intrusion detection systems (IDS) like Snort. We
adversary infrastructure, we were able to determine a clear and recommend that users conduct the following measures to detect
consistent pattern of SOLARDEFLECTION operators relying on and mitigate activity associated with SOLARDEFLECTION:
Tor to obfuscate network traffic.
• Configure your intrusion detection systems (IDS),
Overlaps with the HTML variant of EnvyScout detailed byintrusion prevention systems (IPS), or any network
Sekoia[.]io and findings from other researchers provide invaluable
defense mechanisms in place to alert on — and uponinsight into likely lures such as those suspected to have targeted
review, consider blocking connection attempts to andmultiple embassies. Following this first discovery, other similarfrom — the external IP addresses and domains listed inHTML files reported by Sekoia confirmed a possible targetingthe appendix.
theme centered on “Covid information” based on the title of an• Recorded Future proactively detects and logs malicious
HTML file they attributed to this campaign. This aligns with theserver configurations in the Command and Control
themes of the phishing emails they attributed to this campaign,
Security Control Feed. The Command and Control list
likely targeting embassies that pretended to be providing a status
includes tools used by NOBELIUM and other Russian
update about embassy operations in response to the pandemic.
state-sponsored threat activity groups. Recorded Futureclients should alert on and block these C2 servers toallow for detection and remediation of active intrusions.
• Recorded Future Threat Intelligence (TI), Third-Party
Intelligence, and SecOps Intelligence module users canmonitor real-time output from Network Traffic Analysis
analytics to identify suspected targeted intrusion activity
involving your organization or key vendors and partners.

●

7

CTA-2022-0503

Monitor for domain abuse, such as typosquatdomains spoofing your organization, through the
Recorded Future Brand Intelligence (BI) module.
The SecurityTrails extension is available to any
customer that has a subscription to the ThreatIntelligence or Brand Intelligence modules. The
LogoType source and alerting is exclusive to the
BI module, though the TI module does have access to the data via the Advanced Query Builder.

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

OutlookAs tensions continue to rise in Eastern Europe, we expect
to see a continuation of cyber operations being conducted by
Russian-nexus groups, likely including NOBELIUM, in line withnational strategic interests. Russia will likely also continue toexert influence over other governments, which may lead to
additional computer network operations aimed at furthering
strategic advantage. Typosquatting is likely to remain an integral
technique for multiple threat entities supporting Russian national
interests in the near future. Insikt Group has already observed
groups that support these interests weaponize domains themedaround Russia’s invasion of Ukraine to great effect. This likely
includes not only the domains belonging to one organization,
but third-party partners and vendors with enterprise network
access.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0503

8

CYBER THREAT ANALYSIS

Appendix A — Indicators
The following tables contain domains deemed or assessed as malicious under the heading “X.509 Certificate Domain(Typosquat)”, and their non-malicious associated redirect domains, under the heading “Location Domain”. All domains detailed
in these tables should not be used to infer targeting of their respective affiliation. As detailed within the body of this reporting,several of the domains identified in this appendix have previously been reported by other security researchers since mid-2021,
which have assisted in corroborating Insikt Group’s findings.
SOLARDEFLECTION Domains

9

Location Domain

X.509 Certificate Domain (Typosquat)

Registrar

https://www[.]businessandit[.]com

60daybusinessaudit[.]com

NAMESILO, LLC

https://www[.]vmware[.]com

alifemap[.]com

NAMECHEAP INC

https://www[.]news[.]com

an-4news[.]com

NAMECHEAP INC

https://www[.]newsreview[.]com

cbdnewsandreviews[.]net

NAMESILO, LLC

https://celebs-infor[.]blogspot[.]com

celebsinformation[.]com

NAMESILO, LLC

https://www[.]ohiocpa[.]com

cityloss[.]com

NAMECHEAP INC

https://www[.]crochet[.]com

crochetnews[.]com

NAMESILO, LLC

https://e-blogpro[.]blogspot[.]com

eblogpro[.]com

NAMESILO, LLC

https://fashionweekdaily[.]com/category/news

fashionnewsarticles[.]com

NAMECHEAP INC

https://www[.]startabusinessfast[.]com

faststartbusiness[.]com

NAMESILO, LLC

https://www[.]gallatinnews[.]com

galatinonews[.]com

NAMECHEAP INC

https://www[.]facebook[.]com/Global-Trade-Motors-1603628046591244

globaltrademotors[.]com

NAMESILO, LLC

https://dayproud[.]us

hanproud[.]com

NAMESILO, LLC

https://hungarytoday[.]hu

hostwt[.]com

NAMESILO, LLC

https://www[.]newsteps[.]org

newstepsco[.]com

NAMECHEAP INC

https://www[.]bajaj[.]pe/english/financeovenfinance[.]com

NAMECHEAP INC

https://www[.]pharosjournal[.]com

pharaosjournal[.]com

NAMESILO, LLC

https://rghosts[.]com

rchosts[.]com

NAMESILO, LLC

https://schiebel[.]net

shebelnews[.]com

EPIK INC

https://money[.]cnn[.]com/data/us_markets

stockmarketon[.]com

NAMECHEAP INC

https://www[.]stonecrestonline[.]com

stonecrestnews[.]com

NAMECHEAP INC

news.sky[.]com

stsnews[.]com

NAMESILO, LLC

https://tacomaweekly[.]com

tacomanewspaper[.]com

DOMAINSOVERBOARD.COM LLC

https://onedrive[.]live[.]com

teachingdrive[.]com

NAMECHEAP INC

https://www[.]theadminzone[.]com

theadminforum[.]com

NAMECHEAP INC

https://www[.]t-mobilemoney[.]com/en/home[.]html

themobilecard[.]com

NAMECHEAP INC

https://www[.]theadminzone[.]com

thetravelerspledge[.]com

NAMESILO, LLC

https://www[.]bbc[.]com/news

trendignews[.]com

NAMECHEAP INC

https://homeoutlet[.]com

worldhomeoutlet[.]com

NAMECHEAP INC

CTA-2022-0503

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSISLUNARREFLECTION Domains
Location Domain

X.509 Certificate Domain (Typosquat)

Registrar

https://www[.]easycounter[.]com

bfilmnews[.]com

NAMESILO, LLC

https://dominican[.]news

dom-news[.]com

NAMECHEAP INC

https://ezdiy[.]com

exdiy[.]com

NAMESILO, LLC

https://midcitymessenger[.]com

midcitylanews[.]com

NAMECHEAP INC

https://mindsetsft[.]com

mindsetsoft[.]com

NAMESILO, LLC

https://www[.]newfordtech[.]com

news-techh[.]com

NAMECHEAP INC

https://atpflightschool[.]com

nextgencpe[.]com

NAMECHEAP INC

https://ecobale[.]com/about-ecobale

nordicmademedia[.]com

EPIK INC

https://petslifenews1[.]blogspot[.]com

petslifenews[.]com

NAMESILO, LLC

https://www[.]nasaproracing[.]com

proracingnews[.]com

NAMESILO, LLC

https://spaceheaterparts[.]com

spaceheaterpro[.]com

NAMECHEAP INC

https://www[.]newsanalytics[.]us

theanalyticsnews[.]com

NAMECHEAP INC

https://www[.]dailyworldnewsgazette[.]com

theworldnewsgazette[.]com

NAMECHEAP INC

https://www[.]delivery[.]com

userdelivery[.]com

NAMESILO, LLC

www.recordedfuture.com | Recorded Future ®

CTA-2022-0503

10

CYBER THREAT ANALYSIS

cs2modrewrite Domains
Location Domain

X.509 Certificate Domain (Typosquat)

Registrar

https://www[.]google[.]com

api[.]pcocot[.]com

GODADDY.COM, LLC

https://blizzard[.]com

d2rwiki[.]net

NAMECHEAP

https://rsa[.]com

eu-elb-10[.]rsa[.]eu[.]com

PDR LTD. D/B/A PUBLICDOMAINREGISTRY.
COM

https://www[.]vmware[.]com

eu-elb-11[.]carbonblack[.]eu[.]com

PDR LTD. D/B/A PUBLICDOMAINREGISTRY.
COM

https://www[.]splunk[.]com

forward[.]splunk[.]eu[.]com

GANDI SAS

https://www[.]securedretail[.]com

glogln[.]com

NAMECHEAP INC

https://gfuel[.]com

hefuel[.]com

GODADDY.COM, LLC

https://heroesofthestorm[.]com

herosofthestorms[.]com

NAMECHEAP INC

https://www[.]ftc[.]gov[.]twmergers[.]ftclibrary-gov[.]com

GODADDY.COM, LLC

https://www[.]microsoft[.]com

mic[.]dnsrd[.]com

NAMESILO, LLC

https://www[.]onlinebusinessadvice[.]uk

onlinebusinessadviceuk[.]com

GODADDY.COM, LLC

https://code[.]jquery[.]com/jquery-3.6.0.js

quiz[.]stakeverflow[.]com

NAMECHEAP

https://www[.]financesolutionsuk[.]org[.]uk

ret[.]workman-alerts[.]co[.]uk

NAMECHEAP

https://www[.]microsoft[.]com

saab[.]dnset[.]com

PDR LTD. D/B/A PUBLICDOMAINREGISTRY.
COM

https://google[.]com

support[.]starbulk[.]gr

N/A

https://tsubox[.]com

tsubux[.]com

NAMECHEAP INC

https://www[.]cia[.]gov

update[.]aviraoperations[.]com

CSC CORPORATE DOMAINS, INC.

https://zincone[.]com

zinczone[.]com

NameSilo, LLC

11

CTA-2022-0503

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Cobalt Strike samples affiliated with cs2modrewriteIP

X.509 Certificate Domain (Typosquat)

File Hash

Referral Location

139.99.178[.]56

midcitylanews[.]com

147991cd55a00ebb2ffe8053e49f40d13d334c54d073b083578bbbedcd6b2389

midcitymessenger[.]com

139.99.178[.]56

midcitylanews[.]com

ffa980b2a4a88c68f62288de56e9cfccacbb3f738492f98dff419c5f2f897377

midcitymessenger[.]com

103.232.53[.]230

dom-news[.]com

1. 92534b3d5e69c0be7dad0efed6b5f0133ef00c0227a42853dc62cc383ca747c5

dominican[.]news

2. 76975c897d6010e1faec7c2c4cb4fbf3aa5b09c7cf80fc8fa05831c2439db86a
139.99.167[.]177

cbdnewsandreviews.net

a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf

newsreview[.]com

45.179.89[.]37

hanproud[.]com

c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78

N/A

195.206.181[.]169

tacomanewspaper[.]com

1f5a915e75ad96e560cee3e24861cf6f8de299fdf79e1829453defbfe2013239

tacomaweekly.]com

N/A

1. worldhomeoutlet[.]com
2. theyardservice[.]com

1. ee44c0692fd2ab2f01d17ca4b58ca6c7f79388cbc681f885bb17ec946514088c

N/A

2. ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c9996
06a3a01d464a2a330
159.65.184[.]99

glogln[.]com

43886ea4e57b421bb15bb26f949ef3b1d9056229357b62babb7fec56f7cd0975

securedretail[.]com

45.32.59[.]31

vmtoolsupdate[.]com

N/A

vmware[.]com

13.67.239[.]91

pcocot[.]com

1.

2.

www.recordedfuture.com | Recorded Future ®

1b0318224a1d139510139e1765c5e7b1295fc29c0ee861ea33a1ff4f68a93023
fbd2233ff798f26fb3998f5149af251f07fe4fa06b255dd6b991a569ae8097d5

CTA-2022-0503

google[.]com

12

CYBER THREAT ANALYSISCOSMICNODE Hashes
SHA256

Filename

6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7DeleteDateConnectionPosition.dll

3fcefd837ff32d28ccf3edb65954e595f8bdc06c9975e3cb46b71eefcf1ca770

amber.exe

6473dbb511354618ff5dc332f9a0c035ba6f2699431e2d2e766c830136afb64d

amber.exe

90fb7b856c0d34eaeca78e85a4ad5d699cff6b4140a3514061068232a68bc95a

openvpn.exe

c6a3e82482d42b361d794bee779bff231082e15a7d2552093c46e7136a2c00c5

amber.exe

13

CTA-2022-0503

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

About Insikt Group®
Insikt Group is Recorded Future’s threat research division, comprising analysts andsecurity researchers with deep government, law enforcement, military, and intelligenceagency experience. Their mission is to produce intelligence on a range of cyber andgeopolitical threats that reduces risk for clients, enables tangible outcomes, and prevents
business disruption. Coverage areas include research on state-sponsored threat groups;
financially-motivated threat actors on the darknet and criminal underground; newly
emerging malware and attacker infrastructure; strategic geopolitics; and influence
operations.

About Recorded Future®
Recorded Future is the world’s largest intelligence company. The Recorded
Future Intelligence Platform provides the most complete coverage across adversaries,
infrastructure, and targets. By combining persistent and pervasive automated datacollection and analytics with human analysis, Recorded Future provides real-time visibility
into the vast digital landscape and empowers clients to take proactive action to disrupt
adversaries and keep their people, systems, and infrastructure safe. Headquartered in
Boston with offices and employees around the world, Recorded Future works with morethan 1,300 businesses and government organizations across 60 countries.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

www.recordedfuture.com | Recorded Future ®

CTA-2022-0503

14