Recycled Certificates Tie Russian Hosts to a Loader-to-Miner Chain
Matching TLS certificate serials on unrelated Russian ASNs, and a NICENIC domain pair sharing Cloudflare nameservers, point to a small, reused hosting pool rather than throwaway infrastructure. That fabric underpins a 26-file payload set tracked by CTX Team, from an HTA lure to a shared-imphash MSIL loader trio ending in cryptomining.
Two pairs of IP addresses, sitting on two unrelated Russian-registered autonomous systems, are presenting identical TLS certificate serial numbers — a detail that has nothing to do with coincidence and everything to do with shared infrastructure. On AS29182, operated by JSC IOT out of Moscow, addresses 62.109.31.142 and 37.230.117.113 both serve certificate serial 7b670437a77c69583d393d4c, issued by GlobalSign GCC R6 AlphaSSL CA 2025 for the wildcard subject *.imageban.ru — a legitimate-looking…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read