GoDaddy Certificate Mismatch Exposes Recycled Upatre C2 Infrastructure
A GoDaddy certificate issued for ebuyswap.co.uk in January 2024 instead names *.secure-secure.co.uk, a mismatch that anchors a loosely linked cluster running the decade-old Upatre downloader. Alongside a dynamic-DNS-style nameserver delegation, the anomalies point to cheap, recycled hosting rather than a purpose-built campaign.
A GoDaddy certificate issued in January 2024 for ebuyswap.co.uk carries a subject name of *.secure-secure.co.uk — a domain that has nothing to do with the site it secures. That single mismatch, paired with a second domain delegated to a dynamic-DNS-style nameserver pair, is the most concrete signal in a c2-servers cluster that otherwise leans on a downloader family old enough to have been retired twice over.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read