Suspected KEYPLUG Infrastructure: TLS Certificates and GhostWolf Links

Description

The article analyzes a cluster of network infrastructure associated with KEYPLUG, attributed to a suspected Chinese state-sponsored actor known as RedGolf or APT41. By examining historical TLS certificates and server configurations, researchers uncovered ongoing activity and links to recent operations targeting Italian organizations. The investigation revealed a unique certificate configuration using 'Support_1024' in the Organizational Unit field, along with a specific JA4X fingerprint. This allowed for the identification of active servers potentially linked to the threat actor. The analysis highlights the importance of tracking certificates and incorporating TLS fingerprinting methods for detecting suspicious infrastructure, even when threat actors attempt to blend in with legitimate traffic.