Security researchers have identified new infrastructure clusters linked to the persistent India-based threat group APT-C-35, commonly known as DoNot, confirming its continued active presence and espionage operations targeting government, defense, and diplomatic sectors in South Asia, according to Cyber Security News.
The investigation, led by At-Bay analyst Idan Tarab, employed a structured hunting methodology that uncovered distinct technical markers within the group's web servers, allowing for their tracking and differentiation from legitimate infrastructure. Key detection signatures were found in specific Apache HTTP response headers, most notably the recurring "Expires: Thu, 19 Nov 1981 08:52:00 GMT" paired with "HTTP/1.1 200 OK" status codes across a particular Autonomous System Number (ASN 399629).
This analysis revealed approximately 73 results representing 36 unique IP addresses within the infrastructure cluster, with a primary server identified as gilbertfix.info hosted in Wyoming. The servers exhibited defensive configurations like "Cache-Control: no-store, no-cache, must-revalidate," suggesting a design to prevent caching and secure communications.
