Behind the Curtain of Open-Source Intelligence (OSINT)

Cyber-threat actors are masters of disguise, continually striving to mask their cyber attacks by using hardware, software, or network resources that seem benign. But if threat analysts can track emerging indicators of compromise (IoCs)—such as IP addresses, domains, or URLs that are not native to an internal network—they can implement detection rules that will proactively flag attacks. The curtain opens: the threat is exposed. But if you’re not using OSINT the right way, you’re not getting the full picture.

When OSINT Isn’t Enough

Open-source intelligence is a powerful tool for security teams in investigations, but threat actors know this and try to hide behind reputable results these tools often return. When threat actors use resources that lack malicious associations, they boost their chances of an undetected intrusion by creating a false sense of security for defenders. The resources seem “clean” to defenders, who check them against open-source databases of malicious artifacts.

Below we show the limitations of open-source searches for investigating IoCs; additional research is needed to uncover malicious infrastructure.

Network Infrastructure for Sale

The ReliaQuest Threat Research Team monitors cybercriminal platforms where threat actors trade many types of clean network infrastructure—the hardware and software that enables network connectivity. Figure 1 shows multiple forum threads in which vendors are advertising seemingly innocuous services used to avoid detection, including bulletproof webhosting and network storage.

Figure 1: Vendors offer web-hosting services on a prominent Russian-language cybercriminal forum

The abundant advertisements for clean infrastructure on cybercriminal sites show that threat actors actively solicit, buy, and use these services to evade detection. If such services are used during an attack, network defense systems are unlikely to flag the artifacts resulting from them. And clean results breed that false sense of security, regardless of your organization’s sector, location, or technology stack.

Case Study: IP Address, Citrix NetScaler

On July 19, 2023, a security researcher on Twitter linked the IP address 216.41.162[.]172 to exploitation of a remote code execution (RCE) vulnerability in the application delivery controller Citrix NetScaler (CVE-2023-3519).1 OSINT databases marked the IP address “clean” (see Figure 2).

Figure 2: NetScaler IP address result from OSINT resource VirusTotal on July 19, 2023

We ran the IP address through the passive scanner Shodan and discovered a Secure Sockets Layer (SSL) certificate related to an ASUS wireless router (RT-AC68U) from July 1, 2023. SSL certificates can reveal details about a device; in this case, the SSL certificate showed a link between the IP address and a small office home office (SOHO) router. The national vulnerability database (NIST) ties this router to multiple vulnerabilities, ranging from low to critical severity.

The key takeaways from this case study?

• Threat actors commonly target SOHO routers because they can be easily exploitable—often left unpatched. They can have free rein to perform attacks on benign infrastructure.
• Threat actors often seek seemingly innocent IP addresses for their attacks, to fly under the radar.
• IP addresses aren’t easy to categorize as clean or malicious because internet service providers may dynamically assign them to devices, at random or at scheduled intervals. Consider that on July 20, 2023, only one security vendor on VirusTotal had the NetScaler IP address marked as malicious (see Figure 3).

Figure 3: NetScaler IP address marked malicious by a single vendor on VirusTotal

Case Study: Domains for Staging

Many malware families use legitimate websites for staging: uploading, installing, or otherwise setting up capabilities to use during targeting. The domain salamancaespectacular[.]com was used in a May 2023 attack involving Gootloader. The domain is ostensibly for a website describing guided tours in Salamanca, Spain. Running the domain through an OSINT database (VirusTotal) returned a creation date for the “travel site” of November 2, 2014, and reveals that the domain ranks in the top 1 million most visited domains (which could be interpreted as an indication of credibility from VirusTotal).

Key takeaways?

• The threat actors were using a legitimate business and domain, which lets them hide from defenders.
• The domain’s malicious associations are uncovered by identifying the full URL: salamancaespectacular[.]com/what-is-the-difference-between-legal-ruled-and-wide-ruled-paper. A user might click that URL if it’s placed high in the list of results from a search for, “What is the difference between legal-ruled and wide-ruled paper?” in a search engine.
• This domain and others used in staging often have a vulnerability that allows attackers to inject malicious code into the site. It’s unlikely that a travel website would host information about ruled paper. If something seems out of place, it probably is out of place (and malicious).

Enhancing OSINT

The steps below can help you investigate seemingly innocuous networking artifacts, by enhancing security teams’ use of open-source intelligence.

IoC Detection Opportunities

Security teams could benefit from creating high-priority detections that use curated threat feeds containing high-fidelity IoCs. Below are a few examples, available to ReliaQuest customers whose similar emergency detection needs focus on IoCs we’ve identified.

Detection Rule	Summary
Emergency IP Threat IoC	Allowed communication from an IP address associated with a threat could indicate that an attacker was successful in gaining access and developing persistence with the host.
Emergency Domain Threat IoC	Communications from an internal host to a domain associated with an emergency threat could indicate the internal source is compromised as a part of the threat’s campaign.
Emergency URL Threat IoC	Any communications from an internal host to a URL associated with the threat could indicate the internal source is compromised as a part of the threat’s campaign.