Industry

Exploring the DNS Flipside of SideWinder

The SideWinder advanced persistent threat (APT) group, active since 2012 and known for targeting government, military, and business entities throughout Asia, primarily Pakistan, China, Nepal, and Afghanistan, has struck once again. This time around, the threat actors updated their toolset and created new infrastructure to spread malware and control compromised systems. more

Global Domain Activity Trends Seen in Q1 2025

Based on our Q1 2025 ranking of the most popular gTLDs and ccTLDs, the same players pretty much made the list. The .com gTLD remained in first place while the other gTLD extensions like .xyz, .top, and .shop lagged far behind. Among the ccTLDs, only .de made it to the top 10. more

Attaxion Becomes the First EASM Platform to Integrate ENISA’s EU Vulnerability Database (EUVD)

Attaxion, the external attack surface management (EASM) vendor with industry-leading asset coverage, announces the integration of the European Vulnerability Database (EUVD) into its platform. more

Unlocking the DNS Strongbox of BADBOX 2.0

HUMAN's Satori Threat Intelligence and Research Team recently uncovered and partially disrupted BADBOX 2.0 in collaboration with Google, Trend Micro, Shadowserver, and other partners. The threat has been dubbed "the largest botnet of infected connected TV (CTV) devices" uncovered to date. more

Unearthing the DNS Roots of the Latest Lotus Blossom Attack

Cisco Talos recently uncovered multiple Lotus Blossom cyber espionage campaigns targeting government, manufacturing, telecommunications, and media organizations. The group used Sagerunex and other hacking tools after compromising target networks. more

Detectify vs Intruder: External Attack Surface Management on a Budget

Choosing an attack surface management or a vulnerability management platform often comes down to identifying which tool provides the right mix of visibility, automation, and precision that matches your team's needs, ideally at as low a price as possible. more

Rounding Up the DNS Traces of RA World Ransomware

Symantec recently reported that a China-based threat actor who has been involved in installing backdoors in the systems of target government institutions (i.e., cyber espionage) has turned toward spreading RA World ransomware (i.e., a cybercriminal act) this time. Going from one act to the other is not usual for attackers.  more

IPv4’s Price Dip: Supply Surge Widens the Gap Between Block Sizes

The market for IPv4 addresses is showing signs of a gentle deflation. According to April 2025 sales data from IPv4.Global by Hilco Streambank, the average price per address has declined across all block sizes. more

Tempering Tax Season Troubles with DNS Intel

Each year, threat actors zoom in on U.S. taxpayers in a bid to intercept their payments and line their pockets instead. And while the tax day - 15 April 2025 - has passed, those who need more time can settle their dues up to 15 October 2025 without getting penalized if they requested an extension. more

Decrypting the Inner DNS Workings of EncryptHub

Outpost24 recently discovered that rising cybercriminal entity EncryptHub inadvertently exposed elements of its malicious enterprise. The security investigation unveiled previously unknown aspects of the group's infrastructure, tools, and behavioral patterns. more

Domain Name Industry Brief Reports 368.4 Million Domain Name Registrations in Q1 2025

The first quarter of 2025 closed with 368.4 million domain name registrations across all top-level domains (TLDs), an increase of 4.2 million domain name registrations compared to the previous quarter, according to the latest issue of the Domain Name Industry Brief Quarterly Report released Thursday at DNIB.com. more

Tracing the DNS Footprints of REF7707

The targeted attack campaign REF7707 trailed its sights on the foreign ministry of a South American country in February 2025. According to Elastic Labs, the group behind the campaign has been connected to previous compromises in Southeast Asia. more