#ShadowSyndicate is not a single campaign or threat actor, but a malicious activity cluster formed by numerous servers sharing the same
#SSHkeys. That infrastructure unites various seemingly unlinked operations conducted by different actors.
Analysing ShadowSyndicate infrastructure, we discovered suspicious server transitions from “old” SSH fingerprints to “new” ones. Although it resembles legitimate ownership changes, inaccuracies in threat actor’s OPSEC allowed us to confirm the connection. Newly analyzed server clusters share the same adversarial use and hosting preference patterns with initial ones. Our researchers uncovered how seemingly unrelated activity can be reliably linked over time.
The key findings:
🔹 ShadowSyndicate continues to reuse SSH keys across hundreds of servers, this way connecting large infrastructure clusters.
🔹 ShadowSyndicate implements an earlier unreported server transition technique based on SSH keys rotation between servers.
🔹 Simultaneous fingerprint overlaps on part of the servers – OPSEC inaccuracies – revealed links leading to additional server clusters.
🔹 ShadowSyndicate infrastructure is again used for hosting popular C2 frameworks: Cobalt Strike, MetaSploit, etc.
🔹 Analyzed infrastructure is also linked to multiple
#Ransomware campaigns, such as Cl0p, ALPHV/BlackCat, etc., suggesting an Initial Access Broker or Bulletproof Hosting nature of the attackers.
All the technical details, methodology, and intelligence takeaways are covered in the full analysis.
🔗 Read the blog:
