The Imperative of Infrastructure Tracking in Cybersecurity

In the relentless cat-and-mouse game between defenders and adversaries, understanding and tracking threat actor infrastructure is paramount. It provides critical insights into an attacker's operational methodologies, capabilities, and potential future targets. Beyond merely blocking individual indicators of compromise (IOCs), infrastructure tracking allows cybersecurity professionals to pivot, uncover broader campaigns, predict future attacks, and ultimately disrupt malicious operations at scale. This deep dive explores advanced techniques employed by experts to unmask the digital footprints left by threat actors.

Passive DNS Analysis: Peering into Historical Domain Registrations

Passive DNS (pDNS) is a powerful investigative technique that involves collecting and archiving DNS resolution data over time. Unlike active DNS queries, which resolve a domain to its current IP address, pDNS databases retain historical mappings, showing which IP addresses a domain resolved to in the past, and conversely, which domains resolved to a particular IP address. This historical context is invaluable for uncovering connections that current DNS records might obscure.

Leveraging Passive DNS for Pivoting

The primary utility of pDNS lies in its ability to facilitate pivoting. If you identify a single malicious domain or IP address, pDNS can reveal related infrastructure by:

• Domain-to-IP Pivoting: Discovering all IP addresses a known malicious domain has used over its lifetime. This can expose attacker attempts to migrate infrastructure.

  
  # Conceptual query for a known malicious domain
  lookup_passive_dns(domain="malicious-c2.com")
  # Expected output: List of historical IPs (e.g., 192.0.2.10, 203.0.113.20)
      

• IP-to-Domain Pivoting: Identifying all domains that have resolved to a known malicious IP address. This is crucial for finding other command-and-control (C2) servers or phishing sites hosted on the same infrastructure.

  
  # Conceptual query for a known malicious IP
  lookup_passive_dns(ip_address="192.0.2.10")
  # Expected output: List of historical domains (e.g., phishing-site.net, another-c2.biz)
      

• NS Server Pivoting: If multiple malicious domains share the same Name Server (NS) records, it strongly suggests they are controlled by the same actor. pDNS can reveal these shared NS records.
• Mail Exchange (MX) Pivoting: Similar to NS records, shared MX records can indicate common infrastructure, especially in phishing campaigns where actors might use dedicated mail servers.

Practical Application and Tools

Several commercial and open-source tools provide access to pDNS data. Services like VirusTotal, RiskIQ (now Microsoft Defender Threat Intelligence), Farsight Security DNSDB, and PassiveTotal (now part of RiskIQ) offer extensive pDNS datasets. When investigating a new IOC, a common starting point is to query these databases. For example, if a phishing email points to evil-phish.com, a pDNS query might reveal that evil-phish.com previously resolved to IP 1.2.3.4, and that same IP also hosted another-scam.net and login-update.info. This immediately expands the scope of the investigation.

Certificate Transparency Logs: Unearthing Hidden Connections

Certificate Transparency (CT) is a public logging system designed to detect mistakenly or maliciously issued digital certificates. Every time a Certificate Authority (CA) issues an SSL/TLS certificate, an entry is added to multiple publicly auditable CT logs. While intended for security, these logs provide a treasure trove of information for threat hunters.

How CT Logs Reveal Infrastructure

Threat actors, like legitimate organizations, often use SSL/TLS certificates to encrypt their communications and appear more legitimate. When they request a certificate, details about the domain, subdomains, and sometimes even the organization name are recorded in the CT logs. These details can inadvertently expose their infrastructure in several ways:

• Shared Certificate Attributes: Attackers often reuse patterns in their certificate requests. This could be a specific organization name (even if fake), common email addresses, or specific country/state information. Searching CT logs for these patterns can reveal clusters of related domains.
• Subdomain Enumeration: Threat actors might request wildcard certificates (e.g., *.malicious.com) or certificates for numerous subdomains (c2.malicious.com, login.malicious.com). CT logs provide a comprehensive list of all subdomains ever seen for a given apex domain, which can be far more extensive than what active DNS queries would reveal.
• Typosquatting and Brand Impersonation: Attackers creating phishing sites often register domains similar to legitimate brands (e.g., micr0soft.com). Searching CT logs for certificates issued to variations of known brand names can quickly identify these malicious registrations.

Practical Application and Tools

Tools like crt.sh, Censys, and Shodan actively index CT logs and provide searchable interfaces. For example, to find all certificates issued for domains containing 'microsoft' and 'login' within the last year, you might use a query similar to what crt.sh offers:

# Example crt.sh query for certificates related to 'microsoft' and 'login'
https://crt.sh/?q=%25.microsoft%25&q2=%25login%25

# Example using a conceptual API call to a CT log search service
curl -X GET "https://api.example.com/ct_search?domain_pattern=*.microsoft.com&org_name=Microsoft"

By analyzing the output, you might find certificates issued to highly suspicious domains or organizations that share commonalities with known malicious infrastructure.

IP Reputation Tracking and Geolocation: Unveiling Malicious Footprints

IP reputation tracking involves assessing the trustworthiness of an IP address based on its historical behavior and associated threats. Geolocation, on the other hand, identifies the physical location and network ownership of an IP address. Both are crucial for understanding the context of malicious infrastructure.

Understanding IP Reputation Scores

IP reputation services aggregate data from various sources, including honeypots, spam traps, threat intelligence feeds, and incident reports, to assign a reputation score or category to an IP address. A low reputation score indicates a history of involvement in malicious activities such as:

• Hosting malware or phishing sites
• Acting as a C2 server
• Sending spam or malicious emails
• Engaging in brute-force attacks or scanning

By checking the reputation of an IP, analysts can quickly determine if it's part of known malicious infrastructure or if it warrants deeper investigation.

Geolocation and Network Ownership

Geolocation data provides the country, region, city, and Internet Service Provider (ISP) associated with an IP address. This information helps:

• Identify Anomalies: A C2 server for a campaign targeting Western organizations, but located in a country known for hosting bulletproof services, might raise a red flag.
• Understand Actor Origin: While actors often use VPNs and proxies, persistent patterns in geolocation can sometimes hint at their preferred operational locations or even their general area of operation.
• Determine Hosting Patterns: Certain threat groups favor specific ISPs or cloud providers. Geolocation data, combined with Autonomous System Number (ASN) information, helps identify these patterns.

Practical Application and Tools

Services like AbuseIPDB, Talos Intelligence IP & Domain Reputation Center, Mandiant Advantage, and commercial threat intelligence platforms (e.g., Recorded Future, CrowdStrike Falcon Intelligence) provide comprehensive IP reputation data. MaxMind GeoIP and various WHOIS services offer geolocation and ASN information.

# Example: Querying AbuseIPDB for an IP's reputation
curl -H "Key: YOUR_API_KEY" -G https://api.abuseipdb.com/api/v2/check \
  --data-urlencode "ipAddress=192.0.2.10" \
  -d maxAgeInDays=90 -d verbose

# Example: Basic WHOIS lookup for an IP
whois 192.0.2.10

Analyzing the WHOIS output for the ASN and associated organization can reveal the hosting provider.

Hosting Provider Patterns and ASN Analysis: Following the Digital Breadcrumbs

Threat actors, despite their attempts at anonymity, often exhibit discernible patterns in their choice of hosting providers and network infrastructure. Analyzing these patterns, particularly through Autonomous System Numbers (ASNs), can provide significant insights into their operational preferences and help uncover related infrastructure.

Identifying Bulletproof Hosting and Cloud Providers

Bulletproof Hosting: Some hosting providers are notorious for turning a blind eye to abusive content, making them attractive to threat actors. These 'bulletproof' hosts often operate in jurisdictions with lax regulations or limited cooperation with international law enforcement. Identifying a cluster of malicious IPs all pointing to the same bulletproof host is a strong indicator of a connected campaign.

Cloud Infrastructure: Many threat actors leverage legitimate cloud services (AWS, Azure, Google Cloud, DigitalOcean, Vultr, etc.) due to their ease of provisioning, scalability, and ability to blend in with legitimate traffic. While this makes them harder to distinguish, specific patterns can emerge:

• Consistent use of certain regions or availability zones.
• Repeated use of specific cloud service features (e.g., particular types of virtual machines, load balancers).
• Registration of many domains pointing to dynamic IP ranges within a specific cloud provider's ASN.

Autonomous System Number (ASN) Analysis

An ASN is a globally unique identifier for a group of IP networks operated by one or more network operators that has a single and clearly defined external routing policy. Every IP address belongs to an ASN. Analyzing ASNs allows investigators to:

• Group Related Infrastructure: If multiple malicious IPs belong to the same ASN, especially a smaller or less reputable one, it's highly probable they are related. Actors might register multiple IP ranges or virtual servers within the same ASN.

  
  # Conceptual query to find all domains/IPs associated with a known malicious ASN
  search_threat_intel(asn="AS12345")
  # Expected output: List of domains and IPs hosted within AS12345
      

• Identify Hosting Providers: ASNs are directly tied to ISPs and cloud providers. Knowing the ASN helps identify the underlying hosting entity, which can be crucial for takedown efforts or further investigation.
• Track Actor Migration: Actors might move their operations from one ASN to another. Tracking these shifts can provide insights into their adaptability and resilience.

Practical Application and Tools

Tools like BGPView.io, bgp.he.net, and various WHOIS services allow for ASN lookups and pivoting. By taking a known malicious IP, performing a WHOIS lookup to get its ASN, and then searching for other suspicious activity within that ASN, analysts can uncover vast networks of related infrastructure. For instance, if an investigation starts with an IP `198.51.100.10` and WHOIS reveals it belongs to AS64496 (an example ASN often associated with a cloud provider), further searches for other malicious indicators within AS64496 can expose more of the actor's footprint.

Building Comprehensive Threat Actor Profiles: Synthesizing Intelligence

The ultimate goal of infrastructure tracking is not just to identify individual IOCs, but to synthesize these disparate pieces of information into a comprehensive threat actor profile. This profile goes beyond technical indicators to encompass the actor's operational security (OpSec), preferred tools, tactics, and procedures (TTPs), and even potential motivations.

Components of a Threat Actor Profile

A robust threat actor profile integrates findings from all the techniques discussed:

• Infrastructure Fingerprints:
  • Domain Naming Conventions: Are there consistent patterns in how domains are registered (e.g., use of specific keywords, character substitutions, registration dates)?
  • IP Address Ranges: Do they favor specific subnets or IP blocks?
  • Hosting Providers/ASNs: Which providers do they consistently use, including bulletproof hosts or legitimate cloud services?
  • Certificate Patterns: Are there recurring themes in certificate issuer, organization names, or common fields?
  • DNS Records: Are there unusual or consistent DNS record configurations (e.g., specific TTLs, use of particular DNS providers)?
• Operational Security (OpSec) Habits:
  • Reuse of Infrastructure: Do they quickly abandon compromised infrastructure or reuse it across multiple campaigns?
  • Registration Details: Are there common fake names, email addresses, or phone numbers used in domain registrations?
  • Infrastructure Lifetime: Do they spin up infrastructure for short bursts or maintain it for extended periods?
  • Geographical Preferences: Do they consistently operate from specific regions or use proxies in certain countries?
• Tools and TTPs: While infrastructure tracking focuses on the network layer, understanding the infrastructure helps infer TTPs. For example, if infrastructure frequently includes specific open-source tools or custom malware, it becomes part of the actor's profile.

The Iterative Process of Profiling

Building a threat actor profile is an iterative process. A newly discovered IOC might lead to a pDNS pivot, which uncovers new domains. These domains, when checked against CT logs, might reveal a shared certificate pattern. This pattern, combined with IP reputation data, could point to a specific ASN and hosting provider. Each piece of information enriches the profile, allowing for more accurate predictions and proactive defenses.

"Infrastructure tracking isn't about finding a needle in a haystack; it's about understanding how the haystack is built, who built it, and where they'll build the next one."

By continually enriching these profiles, cybersecurity teams can move beyond reactive defense to anticipate adversary moves, strengthen defenses against known TTPs, and contribute to the broader intelligence community's understanding of global threats.

Conclusion

Tracking threat actor infrastructure is a sophisticated and essential discipline in modern cybersecurity. By meticulously analyzing passive DNS records, scrutinizing certificate transparency logs, evaluating IP reputation and geolocation, and dissecting hosting provider patterns, defenders can piece together the complex puzzle of adversary operations. These techniques, when combined, enable the creation of comprehensive threat actor profiles that are instrumental in disrupting malicious campaigns, attributing attacks, and ultimately enhancing the resilience of digital environments. As adversaries evolve, so too must the methods of tracking their digital footprints, making continuous learning and adaptation critical for all cybersecurity professionals.