TALK: Under the wire - detecting targeted attacks against government networks with JA4 and X509 chain validation
Christy Quinn, Infrawatch
ABSTRACT
This talk is a deep-dive case study into a highly targeted attack against Cisco SSL VPNs used by multiple US government agency networks and several other high value targets. This attack leveraged forged X509 certificate chains to redirect government employees attempting to login to Cisco SSL VPNs via MITMProxy collection servers, without being detected by network defenders. The authors discovered this activity in early 2026 and reported their findings to the FBI for further investigation and containment.
The talk will provide a detailed walkthrough of the specific X509 certificate chain forgery mechanism used by the attackers, including how it has been used at scale by PS2 game hackers seeking to bypass DRM restrictions. It will uncover the links between this mechanism and an entire ecosystem of "Great Firewall Jumper" proxynet and VPN services that use variations of this technique to evade PRC internet censorship, several of which are also used by Chinese APTs as part of their obfuscation infrastructure. It will also demonstrate how the JA4 fingerprinting family, especially JA4X and the brand new JA4Scan, are the perfect weapons to hunt and cluster these certificates at scale.
Attendees will be provided with a unique insight into an unusual and not-publicly-documented attack against US government networks and practical steps that defenders can take to harden their networks against it. Attendees can also expect to gain a better understanding of the value of JA4 techniques and how they provide the edge when hunting adversaries leveraging forged X509 certificates.
Christy Quinn
Christy is a senior researcher at Infrawatch. With over ten years experience in the public and private sectors, he specialises in infrastructure discovery and tradecraft development.
https://www.linkedin.com/in/stirner/
