Industry

A DNS Examination of the Phishing Campaign Targeting Japanese Brokerage Firms

Yahoo! News Japan reported cases where securities accounts were hijacked so cybercriminals could sell stocks without their rightful owners' permission. More than 3,500 fraudulent transactions have already been recorded from January to April 2025 alone, amounting to stock owner losses of ¥300+ billion. more

A DNS Deep Dive into the LabHost PhaaS Infrastructure

The Federal Bureau of Investigation (FBI) shared a warning on 29 April 2025 about the LabHost phishing-as-a-service (PhaaS) campaign that threatened the security of users worldwide, along with a massive list of related indicators of compromise (IoCs). WhoisXML API embarked on an in-depth analysis of the IoCs through a DNS deep dive. more

Radix Releases UA Readiness Study on E-Commerce Platforms to Support Broader Internet Compatibility

Adoption of new short and new long TLDs shows strong momentum, while IDN email compatibility continues to evolve across platforms. more

Addressing the Drop: IPv4 Prices Slide as Larger Blocks Come to Market

The market for IPv4 addresses continues to experience deflationary pressures, with recent data showing a steady decline in prices across all block sizes. According to May 2025 figures from IPv4.Global by Hilco Streambank, average prices per address have been trending downward for nearly a year, with large blocks - particularly /16s - leading the descent. more

New MITRE ATT&CK Groups for 2025: A DNS Deep Dive

The MITRE Corporation updates its list of groups on the ATT&CK page every six months, specifically in April and October each year. The Updates - April 2025 advisory listed seven new groups with corresponding lists of indicators of compromise (IoCs) listed in the References section. Take a look at specific IoC-related details for each group below. more

Exploring the DNS Flipside of SideWinder

The SideWinder advanced persistent threat (APT) group, active since 2012 and known for targeting government, military, and business entities throughout Asia, primarily Pakistan, China, Nepal, and Afghanistan, has struck once again. This time around, the threat actors updated their toolset and created new infrastructure to spread malware and control compromised systems. more

Global Domain Activity Trends Seen in Q1 2025

Based on our Q1 2025 ranking of the most popular gTLDs and ccTLDs, the same players pretty much made the list. The .com gTLD remained in first place while the other gTLD extensions like .xyz, .top, and .shop lagged far behind. Among the ccTLDs, only .de made it to the top 10. more

Attaxion Becomes the First EASM Platform to Integrate ENISA’s EU Vulnerability Database (EUVD)

Attaxion, the external attack surface management (EASM) vendor with industry-leading asset coverage, announces the integration of the European Vulnerability Database (EUVD) into its platform. more

Unlocking the DNS Strongbox of BADBOX 2.0

HUMAN's Satori Threat Intelligence and Research Team recently uncovered and partially disrupted BADBOX 2.0 in collaboration with Google, Trend Micro, Shadowserver, and other partners. The threat has been dubbed "the largest botnet of infected connected TV (CTV) devices" uncovered to date. more

Unearthing the DNS Roots of the Latest Lotus Blossom Attack

Cisco Talos recently uncovered multiple Lotus Blossom cyber espionage campaigns targeting government, manufacturing, telecommunications, and media organizations. The group used Sagerunex and other hacking tools after compromising target networks. more

Detectify vs Intruder: External Attack Surface Management on a Budget

Choosing an attack surface management or a vulnerability management platform often comes down to identifying which tool provides the right mix of visibility, automation, and precision that matches your team's needs, ideally at as low a price as possible. more

Rounding Up the DNS Traces of RA World Ransomware

Symantec recently reported that a China-based threat actor who has been involved in installing backdoors in the systems of target government institutions (i.e., cyber espionage) has turned toward spreading RA World ransomware (i.e., a cybercriminal act) this time. Going from one act to the other is not usual for attackers.  more