Dusting for fingerprints: ShadowSyndicate, a new RaaS player?

This Group-IB joint research identifies a suspected RaaS affiliate named ShadowSyndicate that has deployed the same SSH fingerprint (1ca4cbac895fc3bd12417b77fc6ed31d) across 85 servers since July 2022, with at least 52 used as Cobalt Strike C2s; investigators link the infrastructure to multiple ransomware families (ALPHV/BlackCat, Cl0p, Quantum, Nokoyawa, Royal, Play) and commodity tooling (Cobalt Strike, Sliver, IcedID, Matanbuchus), and provide a full list of IPs, Cobalt Strike watermarks, C2 configs, and correlations to aid attribution and hunting.