Industry

Understanding DNSSEC: Best Practices and Implementation Challenges

DNS Security Extensions (DNSSEC) offer cryptographic safeguards to validate DNS responses, countering spoofing and cache poisoning. While implementation is complex, best practices and third-party services help firms navigate the operational demands of deployment. more

Beneath the Belly of the Latest BlueNoroff Attack: A DNS Investigation

Huntress was alerted to the recent BlueNorroff attack when an end-user reported potentially downloading a malicious Zoom extension on 11 June 2025. As it turned out, the malware came disguised as a Calendly meeting invite from a supposed contact sent via Telegram. more

Deep Dive: 3 Lazarus RATs Caught in Our DNS Trap

Researchers tracked three Lazarus-linked RATs to a vast DNS network, uncovering dormant domains, geolocated IPs, and artifacts tied to financial and cryptocurrency sector intrusions. more

Radix selects Tucows Registry as Back-End Registry Services Provider

Tucows Inc. (NASDAQ: TCX, TSX: TC), a global provider of internet services, and Radix, one of the world's largest portfolio registries, announced today that Tucows Registry, part of the company's Tucows Domains operating segment, has been awarded the contract to provide back-end registry services to Radix. more

A DNS Exploration of the Latest Educated Manticore Attack

Check Point Research published an in-depth analysis of the recent spearphishing attack launched by Iranian threat group Educated Manticore. The attackers targeted Israeli journalists, high-profile cybersecurity experts, and computer science professors from leading Israeli universities. more

COLDRIVER’s MAYBEROBOT in the DNS Spotlight

Russia-linked threat actor COLDRIVER has revamped its malware into a new backdoor called MAYBEROBOT, targeting NGOs and dissidents. Early DNS signals and IP resolutions reveal a methodically evolving cyber-espionage campaign. more

RomCom and TransferLoader IoCs in the Spotlight

Proofpoint released "10 Things I Hate about Attribution: RomCom vs. TransferLoader" detailing connections between RomCom and TransferLoader. While the researchers said the backdoors were typically used by different groups -- RomCom by TA829 and TransferLoader by UNK_GreenSec, they did see similarities between the threat actors' campaigns. more

Chasing After RacoonO365 IoCs Using DNS and Domain Intelligence

A coordinated crackdown on RaccoonO365 reveals the scale of phishing-as-a-service operations, as domain and DNS data expose hundreds of linked artifacts and offer a window into the infrastructure of low-skill cybercrime. more

Scouring the DNS for Traces of the Hiddengh0st and Winos SEO Poisoning Campaign

A Chinese-language SEO poisoning campaign has been uncovered, leading users to fake software sites. Investigators linked the scheme to malware variants and uncovered thousands of malicious domains, subdomains, and IP addresses through DNS and WHOIS analysis. more

DNIB Reports 378.5 Million Domain Name Registrations in Q3 2025

The Domain Name Industry Brief reports 378.5 million total domain name registrations in Q3 2025, marking a 16.2 million increase year over year and offering detailed insights into top TLD, ccTLD, and gTLD trends. more

Cross-Examining the CAPTCHAgeddon Brought on by ClickFix

Guardio reported about the ClickFix stealer that is considered an evolved version of fake browser updates. Instead of relying on a file download, it used fake CAPTCHA pages that allowed it to evade detection more effectively. more

Attaxion Releases Agentless Traffic Monitoring for Immediate Risk Prioritization

Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to and from their digital assets -- all without the need to deploy any agents or sensors on these assets. more

Rounding Up DNS Facts about Operation RoundPress

The Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2025-32433 and CVE-2024-42009 to the Known Exploited Vulnerabilities (KEV) Catalog on 9 June 2025 after they were reportedly abused by APT28 to hack government webmail servers in an operation dubbed "RoundPress." more

IPv4 Market Heats Up as Transaction Volume Surges Despite Price Adjustments

The market for IPv4 addresses, already constrained by finite supply is undergoing a period of subtle yet significant transition. Data from IPv4.Global's July 2025 report reveals a continuing decline in average prices per address - particularly among larger blocks - even as transaction volume sees a notable surge. more

Thumbing through the DNS Trail of the TAOTH Campaign

A cyber campaign targeting East Asian elites leveraged fake web services. DNS forensics uncovered suspicious domains, IP links, and signs of future infrastructure repurposing. more