Unmasking Adversary Infrastructure: How Certificates and Redirects Exposed Earth Baxia and PlugX Activity Published: 2024-10-10 ยท Archived: 2026-04-05 21:23:09 UTC TABLE OF CONTENTS IntroductionIdentifying Earth Baxia InfrastructureIdentifying PlugX Servers Through Anomalous Certificates and RedirectsConclusionEarth Baxia Network Observables Introduction Tracking adversary infrastructure often starts with subtle clues. In this case, unconventional certificates and unique HTTP redirect headers led us to two distinct malicious networks. One network was linked to Earth Baxia, a threat actor identified by Trend Micro believed to be from China, while the other appears to be connected to PlugX, based on our telemetry. While these two infrastructures were tracked independently and are not connected, following these basic indicators helped us map out clusters of servers likely used in network intrusions. This post details the steps taken to uncover and track these networks. Identifying Earth Baxia Infrastructure After reviewing the Trend Micro report, we analyzed the IOCs to identify any additional infrastructure potentially linked to Earth Baxia. Our research uncovered Cloudflare certificates with Subject Alternative Name (SAN) domains resembling those mentioned in the blog post. SANs are extensions within SSL/TLS certificates that list additional domain names, or IP addresses a certificate can secure beyond the primary domain. CloudFlare certificate: SubjectCommonName: CloudFlare Origin Certificate SubjectOrganization: CloudFlare, Inc. SubjectOrganizationalUnit: CloudFlare Origin CA Issuer Country: US IssuerOrganization: CloudFlare, Inc. IssuerOrganizationalUnit: CloudFlare Origin SSL Certificate Authority IssuerLocality: San Francisco DNSNames: *.viet-tel[.]site viet-tel[.]site Copy An example of one of the Cloudflare certificates found at 203.25.119[.]28. https://hunt.io/blog/unmasking-adversary-infrastructure-how-certificates-and-redirects-exposed-earth-baxia-and-plugx-activity Page 1 of 7 We also discovered several self-signed certificates falsely claimed to have been issued by Microsoft, adding to the suspicious nature of the infrastructure. Over the same period, many servers hosting these certificates were also observed to serve the Cloudflare certificates mentioned above. Combined with the HTTP redirects, which we'll mention shortly, these indicators pointed to a small but distinct cluster of 12 likely malicious servers, all of which we attribute to Earth Baxia based on our visibility. The complete list of the IPs, domains, and redirect URLs is included at the end of this post. "Microsoft" self-signed certificate: SubjectCommonName: bing[.]com SubjectCountry: US SubjectOrganization: Microsoft Corporation SubjectOrganizationalUnit: Microsoft IT SubjectLocality: Redmond SubjectProvince: Washington Issuer data: same as above Copy This cert was also seen at 203.25.119[.]28 during the same period. The HTTP 301 redirects we observed were primarily over ports 443 and 8443, directing users to well-known legitimate websites like the FBI, NASA, and eBay homepages. This technique was likely used to create an illusion of benign activity, blending malicious behavior into what seemed like standard traffic patterns. Attackers often leverage open-source redirector tools such as RedGuard or RedWarden to obscure the actual location of command-and-control (C2) servers and evade detection by researchers. However, in this case, there was no evidence that either of these tools was employed, suggesting a custom header was used to achieve a similar effect. HTTP/1.1 301 Moved Permanently Date: Wed, 2 Oct 2024 08:25:21 GMT **Value varies Content-Type: text/html Content-Length: 106 **Value varies Copy HTTP 301 redirect used in Earth Baxia malicious servers. The selection of the redirect URLs used appears strategic, focusing on high-profile organizations in the defense, intelligence, and software sectors. These choices suggest that the attacker(s) aimed to blend into environments where military or government-related traffic is commonplace. https://hunt.io/blog/unmasking-adversary-infrastructure-how-certificates-and-redirects-exposed-earth-baxia-and-plugx-activity Page 2 of 7 Noteworthy Redirect URLs: www[.]jdf.mil[.]jm: This domain belongs to the Jamaica Defence Force (JDF), Jamaica's official military organization. www[.]sap[.]com: Redirects to the official website of SAP, a global leader in enterprise software solutions. www[.]mil[.]ru: The official website of the Russian Ministry of Defense, frequently targeted or spoofed in various campaigns. www[.]mi6.gov[.]uk: This domain redirects to the UK's Secret Intelligence Service (SIS), commonly referred to as MI6, which uses the official domain sis.gov[.]uk. www[.]pao.af[.]mil: A spoof of the Public Affairs Office of the United States Air Force. Visiting this domain results in an HTTP 400 error.