Industry

Uncovering the DNS Underbelly of UNC5174: The Shift from SNOWLIGHT to VShell

UNC5174, a Chinese-sponsored group known for using the open-source reverse shell tool named "SUPERSHELL," struck again. In January 2025, they used a new open-source tool and command-and-control (C&C) infrastructure dubbed "SNOWLIGHT." This time around, they have begun using another tool dubbed "VShell." more

Greater Cyber Resilience Through AI: eco - Association Publishes 5-Step Plan for Companies

eco Association of the Internet Industry releases a white paper outlining a five-step framework to help companies integrate AI securely, counter emerging threats like deepfakes and phishing, and strengthen cyber resilience. more

A Look Back at 11 of the Red Report 2026 Featured Threats

An analysis of 11 cyber threats from Red Report 2026 reveals how attackers exploit core MITRE ATT&CK techniques, with DNS and IoC data exposing early warning signals, infrastructure scale, and evolving tactics across campaigns globally. more

DNIB Reports 392.5 Million Domain Name Registrations in Q1 2026

The first quarter of 2026 closed with 392.5 million domain name registrations across all top-level domains (TLDs), an increase of 24.1 million domain name registrations compared to the first quarter of 2025, according to the latest issue of the Domain Name Industry Brief Quarterly Report released Thursday at DNIB.com. more

Domains: The Overlooked Frontline in IP Protection

Domains have quietly become the primary entry point for online IP infringement, yet most firms lack visibility over portfolios, leaving brands exposed and prompting a shift toward integrated, proactive domain governance and security. more

Down the DNS Funnel and into the Funnull Infrastructure

The Federal Bureau of Investigation (FBI) issued a FLASH report to disseminate indicators of compromise (IoCs) for the Funnull infrastructure that threat actors used to manage domains related to cryptocurrency investment fraud scams between October 2023 and April 2025. The report provided links to two lists. more

Do You Have the Right SSL Certificate Strategy?

As SSL lifecycles shrink and low-cost certificates proliferate, enterprises face mounting operational and security risks. A fragmented, manual approach is no longer sustainable; automation, vendor consolidation and stronger validation are becoming strategic imperatives. more

IPv4 Market Enters 2026 with Softer Prices but Durable Demand

IPv4 prices continued to decline through 2025, particularly for large blocks, yet demand remained resilient as buyer participation broadened, liquidity improved, and the market transitioned toward more efficient price discovery entering 2026. more

An In-Depth Analysis of the Ashen Lepus AshTag-Enabled Attack

A sophisticated campaign by Ashen Lepus targeted Arabic-speaking government entities using a newly identified malware suite, AshTag. Enhanced encryption, obfuscation techniques, and extensive infrastructure analysis signal a notable evolution in the group's tactics. more

A DNS Exploration of Operation Olalampo

MuddyWater's Operation Olalampo targets MENA entities using new malware and Telegram-based control, as DNS analysis uncovers fresh infrastructure, thousands of linked domains, and expanded indicators pointing to a broader, coordinated campaign. more

Unearthing DNS Facts about UAT-8099

WhoisXML API analysis deepens understanding of the UAT-8099 campaign, uncovering expanded DNS infrastructure, early indicators of malicious intent, and thousands of linked artifacts, underscoring the group's evolving tactics and regional focus across Asia. more

Probing the DNS Depths of PeckBirdy

An analysis of DNS and WHOIS data tied to the PeckBirdy C&C framework uncovers expanded infrastructure, linking known IoCs to malicious domains, IPs, and email-connected assets across years of activity. more

Framing the AkiraBot Framework Under the DNS Lens

SentinelLABS recently dug deep into AkiraBot, a framework made to spam website chats and contact forms to promote a low-quality search engine optimization (SEO) service. So far, the bot has targeted 400K+ websites and spammed 80K+ websites since September 2024. more

What Remains of Black Basta Now That Alleged Gang Leader Joined the Most Wanted List?

As authorities pursue Black Basta's alleged leader, new analysis of campaign indicators reveals sprawling infrastructure, thousands of linked domains, and persistent ransomware tactics that rely on phishing, known vulnerabilities, and double-extortion pressure. more

ForceMemo in the DNS Spotlight

Researchers tracing the ForceMemo campaign uncover a sprawling DNS footprint, linking compromised GitHub repositories to suspicious domains, shared infrastructure and fresh artifacts, suggesting a coordinated operation that continues to evolve despite partial attribution. more