In Syndication
At its core, cybersecurity is engaged in something like a cold war with threat actors. It is not a battle of violence but rather a cycle of incursion to detection to rebuff and back again, with espionage as a tool and flipping tactics as a weapon. Sometimes the industry gets to do the incurring itself, resulting in high profile disruptions like Operation Endgame or the ongoing dismantling of Aisuru-Kimwolf. The work is never ending, because the attacks are never ending. I often state that threat actors don’t stop just because one avenue of attack is cut off; they simply find a new one.
Which is where malware-as-a-service comes into play. Brokerages, for lack of a better term, where cybercriminals can shop around and find the malware that’s right for their needs. Among these is ShadowSyndicate, a group hosting mostly ransomware-as-a-service. Detecting these groups often comes down to finding a signature or fingerprint of similar architecture or infrastructure. In this case, it’s SSH keys.
Secure Shell Protocol is a cryptographic network protocol for operating network services securely over an unsecured network. It’s mostly used for remote logging and command line execution and is a legitimate function of connecting devices together. Rather than using simple plaintext passwords for authentication, it uses an encryption system. A pair of digital keys, one public, the other private. In essence, the public key is the authorized endpoint and the private key is unique to the verified user. Ransomware works by changing these keys, thereby putting new encryption on captured data and keeping it from its owner.
ShadowSyndicate offers a number of ransomware toolkits, including Cobalt Strike, MetaSploit, Havoc, Mythic, Sliver, AsyncRAT, MeshAgent and Brute Ratel. I’ve covered some of these in previous reports, notably Cobalt Strike which is an exploited pentesting tool and AsyncRAT, an autonomous remote access trojan. The others are also open source exploitation or C2 tools. Over the last few years, researchers at Group-IB, with help from Intrinsec, have studied the group to determine how and where it operates. They’ve cataloged at least 20 servers used to host and provide the various ransomware toolkits, as well as a number of fingerprints indicative of the group as the ‘supplier’ to various cybercriminals.
The article I’m reporting on today, published two days ago, details a previously unreported trend: the SSH keys are often reused in rotation.
Every packet of data is logged by the device it’s traveling to and from on the internet. It’s why encryption is important to keep data secure and to know it reached its destination as intended. Obfuscation is a common tactic of malware, to make itself look like legitimate traffic so that it evades detection by anti-viral software. Knowing SSH keys is vital to preventing that evasion, since once they are known, they can be blocked. But not just that. Having these fingerprints helps cybersecurity teams trace incursions back to their origin, which is how disruptions are carried out and arrests are made. Most of the ransomwares being provided by ShadowSyndicate are actually abused forms of genuine toolkits, making it even more difficult to tell which ones are being used legitimately and which are exploited. Kudos to Group-IB and Intrinsec, you just made our jobs easier.
Posted, 2/6/26
