Proxyware Campaign Adds Singapore CDN Cluster, Still Resigning Same Builds
Twelve new IPs and eight new domains join CTX Team's tracked indicator set, anchored by three Singapore IPs under AS139341 sharing an identical TLS certificate for a CDN wildcard host. The three signer identities behind the campaign — Bright Data, WEILAI NETWORK TECHNOLOGY, and INNOVATIVE CONNECTING — continue producing near-identical rebuilds months apart.
Three newly observed IP addresses in Singapore — 43.169.13.123, 43.174.132.95 and 43.174.133.38 — all sit under AS139341 (ACE) and all present the identical TLS certificate serial a9573ce73eb9e83e40cd25a3a46eef4, issued by WoTrus RSA DV SSL CA 2 for the wildcard host *.cdn.myqcloud.com. It's the freshest infrastructure fingerprint to emerge from a proxyware distribution operation CTX Team has been tracking since earlier coverage of a signer cluster that kept re-signing the same builds, in a…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read