Vietnamese ISP Netblock, Not C2 Fleet, Behind Allaple Spread
Nineteen of twenty IP addresses in this record trace to a single VNPT Corp netblock in Vietnam, with near-zero detection ratios that look nothing like dedicated attacker infrastructure. Certificates on two of those IPs reveal ordinary Synology and appliance management interfaces, pointing to consumer devices caught in worm propagation rather than a provisioned C2 fleet.
Nineteen of the twenty IP addresses populated in this record sit inside a single netblock — 14.160.0.0/11, registered to VNPT Corp under AS45899 — and every one of them returns a VirusTotal detection ratio of either 0/91 or 1/91. That is not what a dedicated command-and-control fleet usually looks like. Purpose-built C2 infrastructure tends to concentrate on a handful of dedicated hosts with at least some flagged reputation, rented specifically for the operation and often swapped out once…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read