One certificate to rule them all: the story of a Chinese-nexus botnet

One Certificate to Rule Them All: The Story of a Chinese-Nexus Botnet

Speaker: Amaury-Jacques Garçon — Sequoia (partner: Flare)

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=rqcd6OhjfJk

Reading time: ~7 minutes

TL;DR

Sequoia CTI analyst Amaury-Jacques Garçon presented a two-year investigation into a Chinese-nexus Operational Relay Box (ORB) network that grew to approximately 70,000 compromised devices. The investigation began from a single shared self-signed TLS certificate observed across three GobRAT C2 servers, and expanded to expose a multi-layered infrastructure including a previously undocumented backdoor named Bulbature, full-featured C2 management panels with exposed source code, and — on one server — an unintentionally exposed export containing 75,000 compromised host records.

Introduction

In May 2023, Japan's CERT (JPCERT/CC) published a report on a campaign targeting Japanese edge devices using a Go-based malware called GobRAT. GobRAT converts infected devices into Operational Relay Boxes — a class of infrastructure in which compromised routers, cameras, NAS devices, and other internet-exposed hardware are aggregated into a proxy network for relaying attacks. ORBs are increasingly favored by state-sponsored and criminal actors because victim organizations see incoming traffic from seemingly legitimate residential or ISP IPs rather than attacker-controlled infrastructure.

JPCERT's report was technically thorough on GobRAT's capabilities but listed only three C2 servers. Garçon, working as a CTI analyst at Sequoia, began hunting those three servers and noticed immediately that all three shared the same self-signed TLS certificate. A single Shodan/Censys query on the certificate hash revealed substantially more infrastructure. From that initial observation — which he called "a basic query, I admit it totally" — he spent two years mapping a botnet that had been active since at least 2021 and was still growing as of the presentation.

▶ Watch: Investigation starting point and ORB concept (0:00)

The Certificate Pivot: Infrastructure Discovery

The operational security failure at the root of this investigation was simple: the infrastructure operators reused the same self-signed TLS certificate across all their servers. Self-signed certificates are not inherently insecure, but reusing a unique certificate across dozens of hosts creates a permanent, queryable fingerprint in internet scanning databases.

From the three initial C2 servers, Garçon's certificate hash query returned significantly more hosts. Analyzing each discovered host revealed a second distinct self-signed certificate on one of them, giving him a second pivot point. Tracking both certificate hashes across Shodan, Censys, and VirusTotal over two years allowed him to observe the infrastructure's growth in near-real-time.

The resulting timeline showed an infrastructure active since at least 2021 with a steadily increasing rate of new server deployments beginning in 2024. In total, the infrastructure comprised approximately 70 dedicated servers, the majority still active at the time of the talk.

▶ Watch: Certificate pivot and infrastructure mapping (2:00)

Malware: GobRAT and Bulbature

The staging servers hosting malicious files had open directories at the /static path, accessible without authentication. These directories contained two malware families deployed together — GobRAT, as documented by JPCERT, and a second malware never previously published, which Garçon named Bulbature.

GobRAT is written in Go, packed with UPX, and compiled for x86-64, ARM, and MIPS architectures, targeting the diverse hardware ecosystems of edge devices. Its capabilities map directly to ORB operations: starting and stopping a reverse shell, executing arbitrary shell commands, fingerprinting hosts, brute-forcing SSH and Telnet, running HTTP dictionary attacks, launching DDoS, and operating a SOCKS proxy. The malware had been well-documented by JPCERT, so Garçon focused his own analysis on Bulbature.

Bulbature is written in C, also compiled for x86-64, ARM, and MIPS, and packed with UPX. It has never appeared in any prior public reporting. Analysis is complicated by heavy obfuscation: control flow flattening, stripped binaries, more than 1,000 functions, and extensive use of asynchronous programming that makes static and dynamic analysis difficult. Its functionality is primarily network-related.

In execution, Bulbature without arguments first contacts a "Bulbature dispenser" server — a component designed to return a list of three IP:port C2 addresses. It then connects to one of the three and begins listening on a random UDP port for data exchange. Alternatively, when executed with a -port argument, it listens directly on the specified UDP port and also opens a TCP listener on localhost port 8001, presumably for local control.

▶ Watch: GobRAT and Bulbature malware analysis (6:00)

C2 Infrastructure: Exposed Panels and Configuration Mistakes

Proxies Provider Interface

The "proxies provider" servers exposed a web interface on port 8080. Though the login screen was present, a configuration error allowed the frontend JavaScript to be retrieved from the /assets path without authentication, enabling reconstruction of the interface locally.

The reconstructed interface revealed a Nodes tab listing controlled devices with their current operations, VPN/L2TP/HTTPS/SOCKS port configurations, and deployment status. A Security Tunnel tab listed active connections and allowed on-the-fly tunnel creation across selected nodes — the mechanism for anonymous traffic relay. A settings panel configured automatic alerts when a security tunnel remained active for longer than 60 minutes, indicating an operational discipline to rotate tunnels frequently and avoid persistent attribution.

Garçon assessed this panel as the C2 interface for Bulbature and its dispenser, though he acknowledged he had not found direct technical proof linking the two systems.

GobRAT Administration Interface

The GobRAT C2 interface was similarly reconstructable from frontend JavaScript in the /assets path. The dashboard listed compromised bots by IP, device type (router, camera, NAS, Unix), country, status, and a flags column encoding TCP/UDP capability and root access. The task creation system offered three operation types:

• Weak Password: credential brute-force against SSH, Telnet, MySQL, and other services, with upload support for target IP lists
• Exploit (Exp): a plugin framework for customizable network exploitation workflows, allowing arbitrary request header and content modification with pattern-matching response validation
• DDoS: target selection, thread count configuration, and campaign scheduling with optional plugin combination

This architecture described a complete, automated offensive toolbox for credential harvesting, vulnerability exploitation, and volumetric attacks — all controlled from a single administration interface.

▶ Watch: C2 panel analysis and operation types (10:00)

The Exposed Data Export: 75,000 Compromised Hosts

The investigation's most significant finding came when Garçon asked whether the C2 data itself might be accessible on any of the 70+ servers. On one server, an incorrectly configured access control left an open directory containing exported data files named after the interface tabs: node, weakpass, webadmin, and others, with timestamps corresponding to operator export dates.

The node file contained 75,000 lines — each representing a unique compromised IP address. Each record included device type, geolocation, active status, and a message field containing return output from shell commands executed by the operator. The field names matched the column headers in the administration panel dashboard exactly, confirming the export as operator-generated data.

This file enabled construction of a full victimology. A plurality of devices were identified as routers, with cameras and NAS devices also well-represented. Geographic distribution spanned multiple continents. The data provided direct evidence that these devices had been actively managed — commands had been run and outputs logged — rather than merely enrolled and forgotten.

▶ Watch: Exposed data export discovery (16:00)

Attribution: Evidence Pointing to China

Garçon presented his attribution hypothesis with explicit acknowledgment that it remains circumstantial: "I found several pieces of evidence that lead me to make a hypothesis on the origin of this threat." He was careful not to assert formal attribution.

The indicators pointing toward a Chinese nexus included: infrastructure patterns consistent with Chinese APT operational style, staging server directory organization and tooling choices observed in other documented Chinese threat actor campaigns, and the geographic focus of the targeting observed in the compromised host data. The infrastructure's scale — 70,000 compromised devices, actively managed — is consistent with state or state-affiliated operational resources rather than independent criminal groups.

The continued growth of the infrastructure since 2024, the persistent reuse of the same certificate fingerprints despite two years of researcher visibility, and the presence of open directories and misconfigured interfaces suggest operational overconfidence rather than negligence — operators who were not concerned about detection, possibly because they operated with some level of protection.

▶ Watch: Attribution evidence and hypothesis (18:00)

Notable Quotes

"For the last two years, I've been able to track this infrastructure only using a very basic query based on the hash of these two certificates. And this is where we see that the operators have made the mistake of always using the same certificates." — Amaury-Jacques Garçon

"On just one server, over seventy, I found an open directory — and probably due to incorrect access management, I came across this. The node file contained seventy-five thousand lines, and each line corresponds to a unique IP." — Amaury-Jacques Garçon

"This alarm mechanism indicates a desire to rotate the security tunnel as soon as possible. This is a typical behavior of attacker groups trying to cover their tracks." — Amaury-Jacques Garçon, on the 60-minute tunnel rotation policy

Key Takeaways

1. Certificate reuse is a permanent tracking pivot. A single shared self-signed TLS certificate across infrastructure hosts creates a durable fingerprint queryable through Shodan, Censys, and VirusTotal — sufficient to track an entire botnet for years from a single initial indicator.

1. Bulbature is a previously undocumented backdoor. Deployed alongside GobRAT on every staging server in this infrastructure, Bulbature had never appeared in public reporting. Its heavy obfuscation — control flow flattening, 1,000+ functions, async architecture — suggests deliberate investment in detection resistance.

1. Frontend JavaScript exposure can reconstruct closed admin interfaces. Both the Bulbature proxies provider and GobRAT C2 panel exposed their JavaScript source through unauthenticated /assets paths, enabling full interface reconstruction without server-side data access.

1. Operational data exposure can confirm victimology at scale. A single misconfigured access control on one of 70 servers exposed 75,000 compromised host records, providing ground truth for device types, geolocation, and operator interaction history.

1. ORB networks provide systematic deniability for attacks. By routing operations through compromised edge devices, the origin infrastructure remains invisible to victims; only residential and ISP IP addresses appear in attack logs, complicating both attribution and blocking.