Industry

Catching Messenger Phishing Footprints Using a DNS Net

A phishing campaign is currently targeting Facebook business accounts with password-stealing malware. The attackers have been using a massive network of fake and compromised Facebook accounts to send out millions of Messenger phishing messages. more

Bring Your Own IP (AWS-BYOIP) - AWS to Charge for IPv4

On Friday, July 28, 2023, AWS announced they would begin charging for every IPv4 address an account is allocated or using on the platform, starting February 1, 2024. That's a change from the current scheme, which only charges you for addresses you reserve, but aren't using, or if you reassign the same address over a hundred times a month. more

A Log4Shell Malware Campaign in the DNS Spotlight

The Log4Shell zero-day vulnerability, also known as "CVE -- 2021 -- 44228," proved to be one of the worst bugs disclosed in December 2021. And while a patch for it has been made available via the Log4j 2.17.1 release seven days after its discovery, some affected systems could remain vulnerable to date. more

Examining WoofLocker Under the DNS Lens

WoofLocker tech support scams have been wreaking havoc since 2017 but the threat actors behind it don't seem to be done yet. In fact, the threat may have become even more resilient. more

From URSNIF IoCs to Software Spoofing: Using DNS Intel to Connect the Dots

Financially motivated threat actors called "TA544" were first detected in 2017. TA544 is known for high-volume campaigns, sending hundreds of thousands of malicious messages daily. more

Uncovering Suspicious Download Pages Linked to App Installer Abuse

Threat actors have been abusing App Installer, a Windows 10 feature that makes installing applications more convenient. The abuse could lead to ransomware distribution and was likely carried out by financially motivated actors Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674. more

Investigating the UNC2975 Malvertising Campaign Infrastructure

Mandiant's Managed Defense Threat Hunting Team recently published an in-depth study of the malware distributed via what they have dubbed the "UNC2975 malvertising campaign." Users who have been tricked into clicking poisoned sponsored search engine results and social media posts ended up with computers infected with either the DANABOT or DARKGATE backdoor. more

Scanning for LockBit Ransomware DNS Traces

ReliaQuest named LockBit one of the most effective and undoubtedly most prolific currently active ransomware groups today. In fact, the malware topped their latest ransomware quarterly list for the first three months of 2023, a continuation of their 2022 observation. more

IPv4.Global Hits $1 Billion Milestone for IPv4 Sales

Of the five Regional Internet Registries responsible for distributing IP addresses, most have run out of IPv4 addresses. However, there remains a healthy global demand for IPv4 addresses, especially by growing networks. These assets, which rarely appear on balance sheets or asset schedules, have become a source of liquidity for organizations in all sectors with unused blocks of addresses. more

A Peek Under the Hood of the Atomic Stealer Infrastructure

The Atomic Stealer, also known as "AMOS," first emerged in September this year by spreading on Macs disguised as popular applications. This time around, it has been wreaking more havoc in the guise of a fake browser update dubbed "ClearFake." more

Tracing Truebot’s Roots through a DNS Deep Dive

On 12 June, the DFIR Report published an in-depth analysis of a Truebot intrusion that began with several page redirects via a Traffic Distribution System (TDS) and ended with dropping a Master Boot Record (MBR) killer wiper onto a victim's computer. The result? more

The Hidden Secret About Your DNS Zones and Combatting Phishing Campaigns

Phishing and scam campaigns are one of the biggest challenges for businesses and organizations across the globe and continue to evade traditional security measures year after year. more

Rhysida, Not Novel but Still Dangerous: DNS Revelations

Rhysida, a new ransomware currently plaguing users may not be novel, but it's proving to be just as effective. Fortra published an in-depth analysis of the malware currently holding the data of healthcare organizations primarily based in the U.S. hostage. more

IPv4 Price Trends & Expectations

Predicting rational behavior on the part of market participants invites two problems into the resulting projections. First, people almost always include some element of irrational thinking in their decisions. Second, no predictor can know every variable -- even only the rational ones -- or weigh those they know with perfect accuracy. more

Advocacy and Recommendations from the Brand Registry Group on gTLDs, Closed Generics, and IDN Policies

The following is a letter from the Brand Registry Group (BRG) sent to the GNSO Council on Friday, July 14, 2023 . It provides the BRG's perspective on the delayed commencement of the new round of generic top-level domains (gTLDs), the decade-long debate on closed generics, and issues related to Internationalized Domain Names (IDNs). The BRG outlines concerns, commends efforts, and proposes solutions to help advance these important facets of internet policy development. more