Keypoints
- Unconventional SSL/TLS certificates (Cloudflare origin certs and self-signed certs claiming Microsoft) flagged suspicious servers tied to Earth Baxia.
- HTTP 301 redirects on ports 443 and 8443 sent traffic to high-profile legitimate sites (FBI, NASA, eBay) to blend malicious activity with normal traffic.
- PlugX-related servers were discovered by searching for certificates with “AES” in the Subject Organizational Unit and alphabetic Subject/Issuer common names.
- HTTP 302 redirects on ports 80 and 8088 consistently pointed to https://www.google.com, using atypical response formatting (lowercase “ok”, all-caps “LOCATION”).
- A Hunt Advanced Search query including an OU filter and a specific JA4X fingerprint narrowed PlugX infrastructure to five IPs; Earth Baxia cluster comprised ~12 likely malicious servers.
MITRE Techniques
- [T1071] Application Layer Protocol – Use of HTTP redirects to blend malicious traffic with legitimate traffic. [‘Use of HTTP redirects to blend malicious traffic with legitimate traffic.’]
- [T1071.001] Web Protocols – Custom HTTP headers used to obscure command-and-control server locations. [‘Custom HTTP headers used to obscure command-and-control server locations.’]
- [T1003] Credential Dumping (Credential access) – Use of self-signed certificates to impersonate legitimate services. [‘Use of self-signed certificates to impersonate legitimate services.’]
Indicators of Compromise
- [IP Address] Malicious server endpoints observed – 203.25.119[.]28, 45.133.239[.]188, and 10 more IPs tied to the two clusters
- [Domain] Certificate SANs and spoof domains – viet-tel[.]site, visualstudio-microsoft[.]com, and multiple other SAN/domains used on certificates
- [Certificate] Anomalous cert fields and issuers – CloudFlare Origin Certificate (SAN: *.viet-tel[.]site), self-signed certs claiming “bing[.]com” / Microsoft, and certificates with OU containing “AES”
- [Redirect URL] HTTP redirect targets used for evasion – https://www.fbi[.]gov, https://www.google.com
- [Ports] Observed redirect and C2 ports – 443 & 8443 (HTTP 301 redirects), 80 & 8088 (HTTP 302 redirects), and service ports 5000 / 6000 associated with PlugX
- [Fingerprint] Certificate/JA4X identifier – c9d784bbb12e_c9d784bbb12e_795797892f9c (used in Hunt query)
Researchers began by ingesting IOCs from a prior report and pivoted on certificate artifacts, searching for Cloudflare origin certificates and self-signed certs that mimicked Microsoft. For the Earth Baxia cluster they found Cloudflare certificates with SANs like *.viet-tel[.]site and self-signed “bing[.]com” certs at IPs such as 203.25.119[.]28; these hosts served HTTP 301 redirects over ports 443 and 8443 to high-profile sites (FBI, NASA, eBay), a pattern consistent with redirect-based obfuscation of C2 locations.
To identify PlugX-related infrastructure, analysts queried certificate fields for OrganizationalUnit values containing “AES”, constrained Subject and Issuer common names to alphabetic-only patterns, and filtered on a specific JA4X fingerprint. That Hunt Advanced Search returned five unique IPs (e.g., 96.43.101[.]248, 45.133.239[.]188) where services on ports like 5000 and 6000 were observed; these servers returned custom HTTP 302 responses on ports 80/8088 pointing to https://www.google.com, with nonstandard formatting (lowercase “ok”, uppercase “LOCATION”), indicating bespoke redirect behavior likely used for evasive C2 routing.
Operationally, the team combined certificate pivots, SAN/domain correlation, port/service detection, and crafted searches for OU and fingerprint patterns to cluster infrastructure: roughly a 12-host Earth Baxia group and a 5-host PlugX cluster. Those technical steps — certificate attribute analysis, targeted Hunt queries, and inspection of HTTP redirect headers and ports — formed the repeatable detection procedure defenders can adopt to surface similar malicious infrastructure early.
Read more: https://hunt.io/blog/unmasking-adversary-infrastructure-how-certificates-and-redirects-exposed-earth-baxia-and-plugx-activity