Industry

Dissecting 1M+ Malicious Domains Under the DNS Lens

Threat actors continue to abuse the DNS by weaponizing domain names. On 13 April 2023, through our recently launched Threat Intelligence Data Feeds (TIDF), we identified more than 1 million suspicious and malicious domains that figured in phishing, malware distribution, spam, and other cyber attacks, such as brute-force and distributed denial-of-service (DDoS) attacks. more

Discovering Potential BEC Scam Vehicles Through the DNS

Threats tend to become more advanced over time. So is the case of business email compromise (BEC) scams, which according to a SlashNext post, cost companies billions of U.S. dollars in losses per year. more

Subdomain Hijacking Vulnerabilities Report: One in Five DNS Records Are Left in a State in Which They Are Vulnerable to Subdomain Hijacking

Global businesses rely on the internet for everything -- websites, email, authentication, voice over IP (VoIP), and more. It's part of an organization's external attack surface and needs to be continuously monitored for cybercrime attacks and fraud. more

Looking for Traces of Social Media-Based Celebrity Scams in the DNS

Infoblox, in its Q4 2022 Cyber Threat Report, featured a "Meta" coin scam using fake celebrity endorsements targeting users in the European Union (EU). The analysis revealed several indicators of compromise (IoCs), specifically four domains and one IP address, that could help the public avoid the perils the scams posed. more

Uncovering Stolen Card E-Shops Using DNS Intelligence

Ever wondered where the personally identifiable information (PII) phishers steal from victims end up? More likely than not, they're put up for sale on the ever-growing number of online stolen card shops. more

RIPE NCC Suspends IPv4 Waiting List Applications

The RIPE NCC has closed its IPv4 Waitlist to new applications. Existing applications are not affected by this change. more

RIPE NCC Asks Members to Vote on Transfer Fee

The RIPE NCC will ask its members to choose a new charging model in late May 2023. This selected model will be used for 2024. more

Detecting Possible Fraud Vehicles Specific to Latin America and the Caribbean

Although fraud is a global issue, some threats may be unique to certain regions. Accertify listed some subtrends specific to Latin America and the Caribbean (LAC), including those involving the airline and digital wallet industries. more

Drawing the Line Between SYS01 and Ducktail Through DNS Traces

Back in January of this year, we studied the infrastructure of Ducktail, a malware that trailed its sights on Facebook business owners and advertisers. Just this month, Morphisec researchers found a similar threat they've dubbed "SYS01." more

Black Basta Ransomware DNS Investigation Led to OneNote and Courier Impersonation

Among the most active and rapidly spreading ransomware in 2022 was Black Basta. It was first detected in April 2022 and victimized nearly 100 organizations in North America, Europe, and Asia by September that same year. As a ransomware-as-a-service (RaaS) malware, Black Basta employs double extortion to force victims to pay the ransom. more

2023 Update - How Are the Most-Spoofed Brands Represented in the DNS?

Even if cyber attack tactics, techniques, and procedures (TTPs) have become increasingly sophisticated over the years, age-old phishing remains the most-used attack vector to this day.  more

Probing Lorec53 Phishing through the DNS Microscope

Lorec53, a relatively new APT group according to NSFocus, actively targeted various Eastern European government institutions in 2021. The threat actors used well-crafted phishing campaigns to gather and steal data from their targets. Two years after their heyday, is the threat Lorec53 poses gone? Or has the group left still-active traces in the DNS? more