Hacking the Hackers who Hack Hackers - Supply Chain Backdoors in Underground VPN Infrastructure

The talk starts with underground VPN resale operations that advertise cheap or free access through Telegram, and with FirewallFalcon Manager, an open-source server management tool promoted in those channels. The speaker, who runs a honeypot network, noticed the tool's install traffic and its community links, then looked at the operator's activity and at the reseller product built on top of it.

Behind the installer, the research found an SSH configuration exposed to the internet with root access, a secret in a companion project, and a proxy binary that added a rogue root certificate and a hosts-file entry so traffic could be decrypted in transit. Git history of the repository showed an earlier version with a layered install script that hid an encrypted binary and reported the host's details to an attacker-run Telegram bot. That version also created a backdoor user. A DNS component embedded a privileged key, which allowed querying records for roughly 650 installed machines across several regions. Many of those hosts looked compromised, with open ports, misconfigurations, and certificates belonging to unrelated organizations.

The takeaway is that people who deploy hacker tooling can be targeted by that tooling. Operators of rented or stolen servers should treat such scripts as hostile, check certificates and DNS on their hosts, and review repository history and binaries before trusting them. The speaker noted that the project later moved to another code host and that the operation's current status was unclear at the time of the talk.