De-anonymizing ransomware domains on the dark web
Summary: Cisco Talos researchers de-anonymized clear-web infrastructure belonging to the DarkAngels, Snatch, Quantum and Nokoyawa ransomware groups by matching self-signed TLS certificates and favicon hashes against Shodan's index of the public internet. In the Nokoyawa case, a directory traversal flaw in the group's victim chat portal exposed /etc/passwd and /var/log/auth.log, revealing successful root logins from two IP addresses, one tied to GHOSTnet GmbH and another to AS58271, listed under the name Tyatkova Oksana Valerievna.
Key Takeaway: Ransomware crews that run TOR hidden services, DNS privacy proxies and VPS hop-points still lost their cover to a reused certificate, a shared favicon and a misconfigured web server - the same OPSEC failures that let hosting providers and law enforcement act on infrastructure your organization may be defending against.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026