Snowglobe APT Hides C2 Behind Thai Medical Vendor's Subdomains
An espionage cluster tracked as Snowglobe (aka Animal Farm, Sig20) is masquerading as Thai healthcare-software vendor BANGKOK MEDICAL SOFTWARE, routing five distinct subdomains through a single backend IP. A duplicated TLS certificate serial and a templated Let's Encrypt issuance pattern across unrelated registrars form the campaign's strongest — and so far only — evidence trail.
Five subdomains of a single Thai domain — meddup, files, donorcheck, labonline and api-notify, all trailing .bmscloud.in.th — resolve to one IP address, 171.103.78.30, and two of them, labonline and api-notify, present the literal same TLS certificate serial number, 514d02f527f0d4cf66ff4701d9104a1f622, for a *.bmscloud.in.th wildcard.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read