I was mapping the command-and-control infrastructure behind a state-linked intrusion set when the query came back and effectively ended the exercise I thought I was running.
The malware resolved its C2 address by reading a smart contract on a public blockchain. Public reporting described one contract. Working from the chain rather than the sample, I found that contract was one member of a family: Two dozen byte-identical contracts plus a set of variants, all emitting the same event, all stamped out by the same builder. Roughly 30 operator wallets were driving them.
Two of those wallets are plausibly state-aligned. The other 28 or so look like ordinary crimeware.
I went in looking for an actor’s infrastructure. What I found was a product with a customer list.
The convergence story is well covered by now, and CSO has already written about nation-state actors hiding behind criminal tooling. Most of that reporting frames it behaviorally: States are acting like crooks, running ransomware, taking payment. That’s true and it isn’t the part that changes my working day. The narrower thing I keep hitting in casework is structural. State programs aren’t building the infrastructure they run on; they’re renting it, and once you internalize that, several things your SOC does every day stop making sense.
What a shared kit does to your indicators
Start with that ratio, because it’s the whole argument. A state program and roughly 28 unrelated criminal operators were running the same C2 kit, from the same builder, on the same infrastructure pattern. Any fingerprint I write for that kit fires on all 30 of them and tells you nothing about which one is in your network.
That inverts how most of us were trained to think. A shared kit isn’t a weak attribution signal; it’s an anti-signal. It pools unrelated actors under a single indicator. The more distinctive the fingerprint, the more confidently it groups people who have nothing to do with each other.
The defensible read is a shared supplier with independent customers. Two government programs and a few dozen crooks sourced C2 tradecraft from the same criminal market, the way they might all buy the same commercial exploit. I want to be careful about the limits of that claim, because the data invites overreach. I make no operator-level attribution from the on-chain data at all. Nothing about a shared contract family implies the customers know each other, coordinate or share tasking. The nation-state labels attached to two of those wallets come from malware-family attribution done by other researchers on the implants riding the kit, not from anything I read off the contracts. The chain tells you there’s one builder and many buyers. It doesn’t tell you which buyers carry flags.
The same shape keeps showing up in the malware itself. When I worked an Iranian-nexus botnet using that on-chain technique, the tooling turned out to be a Russian-origin criminal service the actor had adopted rather than invented. That’s worth sitting with: A state intelligence service outsourced its C2 layer to a criminal vendor. On several China-nexus loader teardowns I’ve done, I’ve had to hold attribution at low confidence for the same structural reason. Side-loading chains and stock Cobalt Strike are communal property, shared across state and criminal operators alike. In one case the entire payload was off-the-shelf Cobalt Strike. There is nothing in that binary that can tell you who sent it, and any analyst claiming otherwise is reading tea leaves.
The same pattern, from three other directions
I only see my own casework, so it’s worth noting that researchers coming at this from completely different angles land in the same place.
Mandiant approached it from the network side, documenting how China-nexus actors route operations through contractor-run relay networks that undermine the whole concept of actor-controlled infrastructure. Their point about indicator lifespan is the one defenders should sit with: A node’s IP address can cycle out in about a month, so any blocklist built on it is decaying before you finish writing the ticket.
Russia gets there by a different route again. Microsoft and Lumen documented Turla, an FSB-linked group, riding other actors’ infrastructure outright, including commodity Amadey bots, to deliver its own backdoors onto Ukrainian military targets. The detail I find clarifying is that their analysts couldn’t determine whether Turla had paid for the access or simply broken into the criminal panels. When the pros can’t tell purchase from theft, the idea that you’ll infer nationality from infrastructure is finished.
Iran shows up on both sides of the market. CISA, the FBI and DC3 documented an Iranian state-linked group working the criminal underground as an access broker, selling footholds to ransomware affiliates for a cut and hiding its own nationality from its customers.
The motives differ, and that’s the interesting part. Iran and North Korea buy, because sanctions leave them shopping in a market they don’t control. China subcontracts to a domestic industry that exists for the purpose. Russia mostly takes what it wants from actors already in the neighborhood. Four routes, one destination: There is no operator-owned infrastructure left for you to find.
Why this breaks your triage, not just your attribution
Attribution is the part everyone talks about. Triage is the part that costs you money, and almost nobody has updated it.
Most SOCs route severity partly on presumed actor, whether or not anyone wrote it down. Commodity infostealer on a workstation gets a tier-one ticket and a reimage. Suspected state activity gets escalated, gets the retainer call, gets the full hunt. That rule is reasonable, it’s close to universal and it rests on an assumption that no longer holds: That tooling correlates with actor.
Watch what that assumption does. Amadey is textbook commodity crimeware, and in Ukraine it was the delivery vehicle for an FSB backdoor. Play ransomware is a criminal operation, and Unit 42 found a North Korean state group operating inside a Play incident. If your rule is “Amadey is commodity, close it,” you closed an intelligence service’s operation and filed it as adware.
So, three changes, and none of them need new tooling.
Sever severity from attribution. Triage on what the intrusion is doing, not on who you think owns it. Access, persistence, staging, exfiltration and impact are all observable in your telemetry. The operator’s nationality isn’t, certainly not at the moment you have to make the call. Commodity tooling must stop functioning as a de-escalation signal on a host that matters.
Anchor detections on the durable constants rather than the infrastructure. Rented addresses rotate, relay nodes cycle monthly, on-chain C2 repoints for about the price of a coffee. What doesn’t move is the technical fingerprint of the kit: The event signature, a custom cipher’s modified constants, a specific side-load chain, a distinctive string table. Those survive rotation. Build there, and accept that the same rule will fire on a nation-state and a teenager both.
Cap your confidence and put the number in writing. When tooling is communal, tooling-based attribution is worth low confidence at best. Say so in the report. An honest low is more useful than a confident guess, because people make decisions on what you write.
The infrastructure was never going to tell you who they are. It isn’t theirs. Once you stop asking it that question, it becomes a much more useful piece of evidence.
I’ve published the detection content and the on-chain queries from this work on my GitHub.
No Responses