A Domain Pair Provisioned in Lockstep Points to a Templated C2 Build Pipeline
Two decoy domains behind a North Korea-linked loader share identical registration dates, hosting IPs, custom nameservers, and same-day wildcard certificates — a synchrony across four infrastructure layers that organic phishing setups don't exhibit. One domain is independently flagged by an IDS signature as Stonefly-linked C2, confirming the pair was built by a single scripted process rather than assembled piecemeal.
Two decoy domains behind a North Korea-linked loader were not stood up independently — they were minted, hosted, and TLS-certified as a single scripted event. tecnojournals.com and semiconductboard.com were both registered through Gandi SAS on 2024-07-18, both resolve to the identical IP address 34.41.139.193, and both delegate authority to the same custom nameserver pair, ns1.hwrn.net and ns2.hwrn.net, rather than to registrar-default infrastructure.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read