John Althouse
2026
Under The Wire - Detecting Targeted Attacks against US Government Networks with JA4 and X509 Chain Validation
This talk is a deep-dive case study into a highly targeted attack against Cisco SSL VPNs used by multiple US government agency networks and several other high value targets. This attack leveraged forged X509 certificate chains to redirect government employees attempting to login to Cisco SSL VPNs via MITMProxy collection servers, without being detected by network defenders. The authors discovered this activity in early 2026 and reported their findings to the FBI for further investigation and containment.
The talk will provide a detailed walkthrough of the specific X509 certificate chain forgery mechanism used by the attackers, including how it has been used at scale by PS2 game hackers seeking to bypass DRM restrictions. It will uncover the links between this mechanism and an entire ecosystem of "Great Firewall Jumper" proxynet and VPN services that use variations of this technique to evade PRC internet censorship, several of which are also used by Chinese APTs as part of their obfuscation infrastructure. It will also demonstrate how the JA4 fingerprinting family, especially JA4X and the brand new JA4Scan, are the perfect weapons to hunt and cluster these certificates at scale.
Attendees will be provided with a unique insight into an unusual and not-publicly-documented attack against US government networks and practical steps that defenders can take to harden their networks against it. Attendees can also expect to gain a better understanding of the value of JA4 techniques and how they provide the edge when hunting adversaries leveraging forged X509 certificates.
About John Althouse
John Althouse and team are the inventors behind network fingerprinting methods JA3, JARM, and JA4+. These methods are built into nearly every tool that handles network traffic and utilized by threat hunters around the world.Β
John is the founder of FoxIO, a company dedicated to continued research and development of network fingerprinting and cyber security solutions for impossible problems.
