A sprawling malicious infrastructure linked to the ShadowSyndicate cybercrime cluster has been expanded following the discovery of new technical markers that connect dozens of servers to the same operator.

The findings add fresh detail to a threat actor already associated with multiple ransomware groups and widely used attack frameworks.

In a new advisory published by Group-IB, researchers said ShadowSyndicate can be tracked through reused Secure Shell (SSH) fingerprints, a rare operational habit that allows investigators to correlate infrastructure across campaigns.

While the cluster relies on a large number of servers, it consistently uses OpenSSH and repeatedly deploys the same access keys, creating identifiable patterns.

ShadowSyndicate was first publicly documented in 2023 and has remained active since then, continuing to build and maintain infrastructure in a way that analysts describe as unusually consistent.

New Fingerprints and Server Transfers

Recent analysis has confirmed two additional SSH fingerprints tied to ShadowSyndicate activity. These were identified after researchers observed overlaps between previously known servers and newly deployed infrastructure, suggesting continued coordination rather than independent reuse.

What stands out in the latest findings is a newly observed technique in which servers appear to be transferred between internal infrastructure clusters.

In theory, this mimics legitimate server ownership changes. In practice, overlapping SSH keys exposed continuity between the old and new environments, allowing researchers to establish attribution.

Read more on ransomware infrastructure analysis: DragonForce Engages in "Turf War" for Ransomware Dominance

The same hosting providers and autonomous systems continue to appear across multiple ShadowSyndicate clusters. While ownership and geographic location vary, the repeated reliance on familiar networks has made the infrastructure easier to map over time.

Links to Ransomware Groups and Attribution 

At least 20 servers associated with ShadowSyndicate were identified as command-and-control (C2) nodes for a range of offensive tools. These include commercial red-team frameworks and open-source post-exploitation platforms, indicating the infrastructure is designed to support multiple attack styles.

Researchers also observed links between ShadowSyndicate servers and affiliates of several ransomware operations, sometimes with moderate to high confidence. Groups associated with parts of the infrastructure include Cl0p, ALPHV/BlackCat, Black Basta, Ryuk and Malsmoke.

Despite the growing body of evidence, however, ShadowSyndicate's exact role in the cybercrime ecosystem remains unclear. 

"While it's still not possible yet to fully confirm the exact nature of ShadowSyndicate, Group-IB's current intelligence primarily points to the following options: either they operate as an Initial Access Broker (IAB) or offer bulletproof hosting (BPH) provider services," the security researchers wrote.

The research was conducted using Group-IB telemetry, public sandboxes and open-source data, with contributions from Intrinsec.

To defend against this threat, Group-IB recommended incorporating indicators of compromise (IoC) from the research into threat intelligence platforms and monitoring activity linked to frequently used autonomous systems.

The firm also advised watching for repeated MFA failures, rapid credential-based logins, unusual login locations and mismatches between login attempts and 2FA or MFA prompts.