<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-ransomware-group-infrastructure
description: >-
  Map and analyze ransomware group infrastructure including C2 servers,
  bulletproof hosting, cryptocurrency wallets, dark web leak sites, and
  affiliate panels. Covers passive DNS analysis, TLS certificate pivoting,
  blockchain analysis, and Tor hidden service enumeration for intelligence
  production and law enforcement support.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - infrastructure-analysis
  - c2-tracking
  - passive-dns
  - blockchain-analysis
  - dark-web
  - tls-pivoting
  - bulletproof-hosting
  - ransomware-infrastructure
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486", "T1583"]
---

# Analyzing Ransomware Group Infrastructure

## Overview

Ransomware groups maintain infrastructure for C2 communications, victim
negotiation, data leak hosting, affiliate management, and cryptocurrency
laundering. Mapping this infrastructure enables proactive blocking, law
enforcement collaboration, and attribution analysis.

Infrastructure analysis uses passive techniques: DNS pivoting, TLS
certificate analysis, WHOIS correlation, and blockchain tracing.
Active scanning of attacker infrastructure should only be performed
under legal authorization.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| dig/nslookup | DNS resolution | Built-in |
| whois | Domain registration | `apt install whois` |
| jq | JSON processing | `apt install jq` |
| curl | API queries | Built-in |
| openssl | TLS certificate analysis | Built-in |

## Key Concepts

### Ransomware Infrastructure Components

```
1. C2 Servers — Command and control for deployed beacons
   └─ VPS providers, bulletproof hosting, compromised servers

2. Affiliate Panel — Web interface for affiliate management
   └─ Tor hidden services, credential-gated access

3. Leak Site — Public data leak/extortion platform
   └─ Tor hidden services, clearnet mirrors

4. Payment Infrastructure — Cryptocurrency collection
   └─ Bitcoin/Monero wallets, mixing services, exchanges

5. Communication Channels — Negotiation with victims
   └─ Tox, custom Tor chat, email (ProtonMail, Tutanota)
```

### Infrastructure Pivoting Techniques

| Technique | Data Source | Intelligence Output |
|----------|-----------|-------------------|
| Passive DNS | DNS history databases | Related domains, IP history |
| TLS Certificate | Certificate transparency | Shared infrastructure |
| WHOIS Correlation | Domain registration | Common registrant patterns |
| IP Neighborhood | Same-subnet analysis | Co-hosted infrastructure |
| Blockchain Analysis | Bitcoin/Monero ledger | Payment flows, exchanges |

## Workflow

### Step 1 — Passive DNS Analysis

```bash
# Resolve known C2 domain and check history
dig +short suspicious-domain.com A
dig +short suspicious-domain.com NS

# Check passive DNS via SecurityTrails API
curl -s "https://api.securitytrails.com/v1/domain/suspicious-domain.com" \
  -H "apikey: <ST_KEY>" | jq '.current_dns'

# Get DNS history
curl -s "https://api.securitytrails.com/v1/history/suspicious-domain.com/dns/a" \
  -H "apikey: <ST_KEY>" | jq '.records[] | {first_seen, last_seen, values}'

# Reverse DNS — find other domains on same IP
dig +short -x <C2_IP>
curl -s "https://api.securitytrails.com/v1/domains/list?include_ips=true&ipv4=<C2_IP>" \
  -H "apikey: <ST_KEY>" | jq '.records[]'
```

### Step 2 — TLS Certificate Pivoting

```bash
# Extract TLS certificate from C2 server
echo | openssl s_client -connect <C2_IP>:443 -servername <DOMAIN> 2>/dev/null | \
  openssl x509 -noout -text | grep -E "Subject:|Issuer:|DNS:|Serial"

# Search Certificate Transparency logs via crt.sh
curl -s "https://crt.sh/?q=%25.suspicious-domain.com&output=json" | \
  jq '[.[] | {name_value, issuer_name, not_before, not_after}]' | head -50

# Pivot on certificate serial number
curl -s "https://crt.sh/?serial=<SERIAL>&output=json" | \
  jq '[.[] | {common_name, name_value}]'
```

### Step 3 — Blockchain Analysis for Ransom Payments

```bash
# Check Bitcoin address on blockchain.info
curl -s "https://blockchain.info/rawaddr/<BTC_ADDRESS>?limit=10" | \
  jq '{address, n_tx, total_received, total_sent, final_balance}'

# Get transaction details
curl -s "https://blockchain.info/rawtx/<TX_HASH>" | \
  jq '{hash, time, inputs: [.inputs[].prev_out.addr], outputs: [.out[] | {addr, value}]}'

# Check address on abuse databases
curl -s "https://www.bitcoinabuse.com/api/reports/check?address=<BTC_ADDRESS>&api_token=<TOKEN>" | \
  jq '.'
```

### Step 4 — Infrastructure Correlation

```bash
# WHOIS analysis for domain registration patterns
whois suspicious-domain.com | grep -iE "registrant|creation|registrar|email"

# Check Shodan for C2 server details
curl -s "https://api.shodan.io/shodan/host/<C2_IP>?key=<SHODAN_KEY>" | \
  jq '{ip_str, org, isp, os, ports, hostnames}'

# Check IP reputation
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=<C2_IP>" \
  -H "Key: <ABUSEIPDB_KEY>" \
  -H "Accept: application/json" | \
  jq '.data | {abuseConfidenceScore, totalReports, countryCode, isp}'
```

## Detection

```yaml
title: Ransomware Group Infrastructure Detection
id: 9a52f2a3-56e5-4aa7-9f33-0009f18d8b8c
status: experimental
description: Detects suspicious activity related to analyzing ransomware group infrastructure techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.t1583
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Known C2 indicators enriched with passive DNS and certificate data
- [ ] Infrastructure mapping documented with pivot points
- [ ] Blockchain analysis completed for known ransom wallet addresses
- [ ] Findings shared with law enforcement via established channels
- [ ] IOC blocklists updated with discovered infrastructure
- [ ] Intelligence products shared with sector ISACs under TLP protocol

## References

- MITRE ATT&CK T1583: Acquire Infrastructure
- MITRE ATT&CK T1584: Compromise Infrastructure
- Chainalysis: Ransomware Cryptocurrency Analysis
- SecurityTrails: Passive DNS Intelligence
- Certificate Transparency: crt.sh
