Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Domains/URLs

rb.aliyuntsl.com 

br.team-c2.com 

hwlocal.team-hw.com 

br.team-hw.com 

data.mirrors-inc.com 

team-hw.com 

update.team-c2.com 

devops.aliyuntsl.com  

bageyi.kernel-lib.com  

8yiu.kernel-lib.com

dnslog.kernel-lib.com

js.ai-jquery.com

api.onlinevrgame.com 

file.ijjjst23m.com

kerneltty.com

80.443.team

up.443.team

404.443.team

data.windows-update-cdn.com 

microsoft-azure-loadbalance.com

update.aliyun.la

api.gitlab.bet

github.la

update.opentls2.com

IP Address

154.84.62.160 

154.84.62.128 

154.84.62.149 

154.84.62.145 

15.228.251.82 

56.124.87.60  

18.229.255.14 

18.166.208.57 

18.228.136.28 

43.198.248.193

43.199.133.195

18.166.243.179

18.164.116.24 

13.203.9.172 

43.198.30.170 

18.162.210.53 

56.125.218.234

18.228.195.216

56.124.49.89 

54.207.196.189

165.22.101.200

172.80.8.202 

104.206.37.134

108.187.28.158

202.146.222.18

192.253.229.23

16.162.255.92

13.250.18.158

18.163.182.231

204.16.172.106

Hash

232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017

088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815

88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0

9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb

263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31

12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d

5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611

e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052

fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d

c3c09fe219e10808f053e580628aeb87b1f00fc683c810aa828905fe03cda98f

2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91

1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a

f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf

5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8

0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7 

5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710

c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69 

c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882

582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9

3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb 

02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6

16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844

a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162

d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b

44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f

45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88

1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c

fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3

adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc

0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e

ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e

ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248

94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a

3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1

0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e

114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0

297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7

0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d

749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52

8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c

98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322

bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838

24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12

2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035

52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611

9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb

d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4

b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877

f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063

2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c

99b5404df81992cad104dd242bc736d75fd6c58af34dc1a75a8ee3c5e1784fa4

85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a

cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109

154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40

67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b

e8bc706b0b007d6a122c6b19e87451e550baee793540774db13b9a08803ed76a

f32dfbe4a2c11a975d735297bf76f6497ce9f5789ab8eaaef3fdd182c2f1f7b1

c59ebe5cf45935c7b5f91b5936fe2c8a5feb7ca161e40ca4e3fb93e447373fa6

3537bfeaf2c18feafeaf773700a88118fd50979d97f2c42c7e34ba6c9aa62820

2949f0b16b83b35dc8a3dfa11815b9516403e3997e13100e7b86f3bb81f6c283

0e7c96a22e3612c68866a8693cc583df95972d3444978ce163c024a45682133a

7d9f5eb3f704607e6f63681842f48071cc58f2f2e63b16b64a49440cb4b9e6e3

8a64d368ce14c5a1f5e775714bcc02f080d0541360743bb4235e0d640f1787b1

36cf87fe2e29cc8b0fd84fce91d70e62a4c4d2fc5f9650dc37440d629ae61b8f

090e886e5605255ad5708e1f27aecc54319de835abd28853e54182981410707e

fa7d8c44a0ecb5ec40832d0d2cfe22c47879317177eae88d178e156f1c8d61a3

d948b486c740b66642a5ae29dc1cb80da703ad40296bcda34a1b27216b63a5cd

612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c

96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148

Detection Query 1 :

domainname like "github.la" or url like "github.la" or siteurl like "github.la" or domainname like "rb.aliyuntsl.com" or url like "rb.aliyuntsl.com" or siteurl like "rb.aliyuntsl.com" or domainname like "update.team-c2.com" or url like "update.team-c2.com" or siteurl like "update.team-c2.com" or domainname like "api.gitlab.bet" or url like "api.gitlab.bet" or siteurl like "api.gitlab.bet" or domainname like "devops.aliyuntsl.com" or url like "devops.aliyuntsl.com" or siteurl like "devops.aliyuntsl.com" or domainname like "up.443.team" or url like "up.443.team" or siteurl like "up.443.team" or domainname like "js.ai-jquery.com" or url like "js.ai-jquery.com" or siteurl like "js.ai-jquery.com" or domainname like "80.443.team" or url like "80.443.team" or siteurl like "80.443.team" or domainname like "data.windows-update-cdn.com" or url like "data.windows-update-cdn.com" or siteurl like "data.windows-update-cdn.com" or domainname like "dnslog.kernel-lib.com" or url like "dnslog.kernel-lib.com" or siteurl like "dnslog.kernel-lib.com" or domainname like "api.onlinevrgame.com" or url like "api.onlinevrgame.com" or siteurl like "api.onlinevrgame.com" or domainname like "microsoft-azure-loadbalance.com" or url like "microsoft-azure-loadbalance.com" or siteurl like "microsoft-azure-loadbalance.com" or domainname like "br.team-hw.com" or url like "br.team-hw.com" or siteurl like "br.team-hw.com" or domainname like "file.ijjjst23m.com" or url like "file.ijjjst23m.com" or siteurl like "file.ijjjst23m.com" or domainname like "update.opentls2.com" or url like "update.opentls2.com" or siteurl like "update.opentls2.com" or domainname like "data.mirrors-inc.com" or url like "data.mirrors-inc.com" or siteurl like "data.mirrors-inc.com" or domainname like "br.team-c2.com" or url like "br.team-c2.com" or siteurl like "br.team-c2.com" or domainname like "hwlocal.team-hw.com" or url like "hwlocal.team-hw.com" or siteurl like "hwlocal.team-hw.com" or domainname like "8yiu.kernel-lib.com" or url like "8yiu.kernel-lib.com" or siteurl like "8yiu.kernel-lib.com" or domainname like "404.443.team" or url like "404.443.team" or siteurl like "404.443.team" or domainname like "kerneltty.com" or url like "kerneltty.com" or siteurl like "kerneltty.com" or domainname like "update.aliyun.la" or url like "update.aliyun.la" or siteurl like "update.aliyun.la" or domainname like "team-hw.com" or url like "team-hw.com" or siteurl like "team-hw.com" or domainname like "bageyi.kernel-lib.com" or url like "bageyi.kernel-lib.com" or siteurl like "bageyi.kernel-lib.com"

Detection Query 2 :

dstipaddress IN ("54.207.196.189","56.125.218.234","108.187.28.158","43.198.30.170","18.166.243.179","18.164.116.24","172.80.8.202","56.124.87.60","202.146.222.18","18.162.210.53","18.166.208.57","18.228.195.216","16.162.255.92","18.228.136.28","56.124.49.89","13.203.9.172","15.228.251.82","18.163.182.231","43.198.248.193","13.250.18.158","192.253.229.23","18.229.255.14","154.84.62.145","43.199.133.195","154.84.62.160","104.206.37.134","154.84.62.149","154.84.62.128","165.22.101.200","204.16.172.106") or srcipaddress IN ("54.207.196.189","56.125.2 18.234","108.187.28.158","43.198.30.170","18.166.243.179","18.164.116.24","172.80.8.202","56.124.87.60","202.146.222.18","18.162.210.53","18.166.208.57","18.228.195.216","16.162.255.92","18.228.136.28","56.124.49.89","13.203.9.172","15.228.251.82","18.163.182.231","43.198.248.193","13.250.18.158","192.253.229.23","18.229.255.14","154.84.62.145","43.199.133.195","154.84.62.160","104.206.37.134","154.84.62.149","154.84.62.128","165.22.101.200","204.16.172.106")

Detection Query 3 :

sha256hash IN ("67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b","a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162","d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b","b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877","cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109","3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb","12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d","0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e","5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710","96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148","ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e","ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248","16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844","263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31","154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40","f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063","c59ebe5cf45935c7b5f91b5936fe2c8a5feb7ca161e40ca4e3fb93e447373fa6","f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf","fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3","2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c","2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91","88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0","1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c","582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9","e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052","adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc","0e7c96a22e3612c68866a8693cc583df95972d3444978ce163c024a45682133a","0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7","5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611","02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6","c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882","9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb","d948b486c740b66642a5ae29dc1cb80da703ad40296bcda34a1b27216b63a5cd","f32dfbe4a2c11a975d735297bf76f6497ce9f5789ab8eaaef3fdd182c2f1f7b1","c3c09fe219e10808f053e580628aeb87b1f00fc683c810aa828905fe03cda98f","45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88","94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a","d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4","2949f0b16b83b35dc8a3dfa11815b9516403e3997e13100e7b86f3bb81f6c283","99b5404df81992cad104dd242bc736d75fd6c58af34dc1a75a8ee3c5e1784fa4","612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c","44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f","85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a","fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d","e8bc706b0b007d6a122c6b19e87451e550baee793540774db13b9a08803ed76a","c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69","232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017","088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815","9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb","1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a","5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8","3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1","0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e","114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0","297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7","0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d","749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52","8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c","98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322","bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838","24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12","2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035","52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611","3537bfeaf2c18feafeaf773700a88118fd50979d97f2c42c7e34ba6c9aa62820","7d9f5eb3f704607e6f63681842f48071cc58f2f2e63b16b64a49440cb4b9e6e3","8a64d368ce14c5a1f5e775714bcc02f080d0541360743bb4235e0d640f1787b1","36cf87fe2e29cc8b0fd84fce91d70e62a4c4d2fc5f9650dc37440d629ae61b8f","090e886e5605255ad5708e1f27aecc54319de835abd28853e54182981410707e","fa7d8c44a0ecb5ec40832d0d2cfe22c47879317177eae88d178e156f1c8d61a3")