In this blog, we will identify 36 Latrodectus phishing domains through passive DNS analysis of a domain reported on Twitter/X.

The initial reported domain leverages 302 redirects to send users to a malicious or benign file. The URL in the 302 redirect is re-used across numerous domains; we can leverage this information to identify additional infrastructure.

In summary, we will use the following indicators to identify the additional servers

  • The same resolved IP address 193.106.174[.]218
  • The same usage of 302 redirects to the same URL on documentcloud[.]org
  • Previous usage of 302 redirects to harvardlawreview[.]org

The primary tooling we will be leveraging is Validin.

Validin
Validin offers cutting-edge DNS, certificate, and crawling data services to empower threat researchers and corporate security teams. Identify, track, and mitigate risks with our advanced threat intelligence solutions.
Validin

Initial Intelligence

The initial intelligence in this blog is from a tweet posted by @Unit42_intel.

The tweet details a Latrodectus infection leveraging phishing links to redirect victims to a javascript file, which ultimately loads LummaStealer Malware.

Within the original tweet, there is a screenshot of a phishing link contained in an email. This link contains the domain lufyfeo[.]org, which will form the basis and starting point of our analysis today.

Our goal is to analyse this domain to identify patterns or indicators that can identify additional domains and IOCs.

Initial Notes

Based on information contained in the initial post, the lufyfeo[.]org domain is likely leveraging redirects to send a victim to alternate "fake" pages.

This information will form an important step in our next analysis, as we will leverage patterns in the 302 redirects to identify additional domains.

Thread-hijacked email>link>redirects to fake Azure page>Firebase URL>.js file download> victim double-clicks JS file> wscript runs JS file> JS generates WebDAV traffic for MSI> MSI installs Latrodectus DLL>Latrodectus C2? Lumma EXE sent over Latrodectus C2

Initial Analysis With Passive DNS

Our initial analysis can begin by searching the lufyfeo[.]org domain using a passive DNS tool such as Validin.

This will reveal detailed history about resolved IP addresses have been in use by the domain.

In the below screenshot, we can see that the most recent IP resolution was 193.106.174[.]218

This IP address will form our first pivot point.

After determining the most recent IP address, we can also review the most recent host responses for the lufyfeo[.]org domain.

This reveals the presence of multiple 302 redirects, which are likely redirecting the user to the next malicious page.

By viewing additional information about the 302 redirect, we can see that the redirect location is a PDF file hosted on documentcloud[.]org

By researching the documentcloud[.]org domain, this appears to be a legitimate site used for hosting pdf files.

Investigating this exact PDF link on urlscanAfter investigating this exact PDF link on urlscan, I found that it appears to be a relatively benign PDF file.

I did not confirm 100%, but I believe that this is a non-malicious PDF returned if the user has not requested the exact URL provided in the initial email.

Leveraging Redirects as Pivot Points

At this point, we have now identified the most recent IP address used by lufyfeo[.]org, and we have identified that the domain is leveraging 302 redirects to send the user to the next location.

Recall that the lufyfeo[.]org domain contains host responses with 302 redirects.

By expanding our search to the most recent resolved IP address for lufyfeo[.]org, we can expand this search to other domains hosted on the same server.

We can check this by searching for the most recent resolved IP 192.106.174[.]218 and checking the Host Responses tab for 302 redirects.

Reviewing the redirect details for interiourbydennis[.]com, we can see that the 302 redirects to the same location.

A very similar response can be observed for deqytuu9[.]org and web3rse[.]org

Of extremely interesting note is that the deqytuu9[.] domain resolves to a pdf file hosted on harvardlawreview[.]org

To my knowledge, this is a legitimate domain and legitimate file, but it is interesting to note that other sites hosting PDFs are being leveraged.

This will become more important later when we do additional pivoting.

Identifying All Current Domains

At this stage, we have identified an IP address 193.106.174[.]218 that is hosting both the original malicious domain lufyfeo[.]org as well as numerous other domains showing similar behaviour.

In total, there are 1256 host responses for the 193.106.174[.]218 address. Our next goal will be to enumerate all of these for indications of 302 redirects to URLs containing pdf references on harvardlawreview[.]org or documentcloud[.]org

Since the number of responses was so large, I utilised the JSON export feature of Validin to obtain the complete results of the search.

This allowed me to focus on information like the 302 redirect location.

We can start this by exporting all entries in the current response.

After exporting the entries, CyberChef can be leveraged to beautify the JSON output and determine which fields are of interest.

In this case, we want only the host and location fields within the JSON.

Enumerating JSON Output With Python

Since we only need to check the location and host fields, we can use a small Python script to enumerate all results in the JSON output for references to URLs with PDF references.

Running this script produces many results for redirects to the same location as the known malicious domain.

After deduplicating the results, we are left with 36 domains hosted on the same IP address and redirecting to the same documentcloud[.]org file, or the additional harvardlawreview[.]org file.

The complete list of these domains can be found below. 

mayanui[.]com
quwezui[.]org
durete[.]org
hofaty[.]org
qeqady[.]org
fuwer[.]org
defifya[.]org
gotuqoa[.]org
suzabyu[.]org
web3rse[.]com
interiourbydennis[.]com
sytukoe8[.]org
lufyfeo[.]org
boldenslawncare[.]com
qyjifia[.]org
vajosoo[.]org
sabehey[.]org
nevujo[.]org
lyzupoy[.]org
mypusau[.]org
zuwagie6[.]org
marypopkinz[.]com
simanay[.]org
cabobao3[.]org
ticava[.]org
zefos[.]org
fazadoe[.]org
luhuhu[.]org
cuxu[.]org
pubonao[.]org
xacygo[.]org
deqytuu9[.]org
gejyg[.]org
pucak[.]org
intellipowerinc[.]com
gejyg[.]org
The link has been copied!