Industry

Baring the DNS Traces of the Slow Pisces Attack on Cryptocurrency Developers

Palo Alto Unit 42 reported on the latest Slow Pisces attack that engaged with cryptocurrency developers on LinkedIn. The threat actors posed as potential employers and sent malware disguised as coding challenges. Developers who took on the challenge ended up running a compromised project, infecting their systems with RN Loader and RN Stealer. more

Uncovering the DNS Underbelly of UNC5174: The Shift from SNOWLIGHT to VShell

UNC5174, a Chinese-sponsored group known for using the open-source reverse shell tool named "SUPERSHELL," struck again. In January 2025, they used a new open-source tool and command-and-control (C&C) infrastructure dubbed "SNOWLIGHT." This time around, they have begun using another tool dubbed "VShell." more

Down the DNS Funnel and into the Funnull Infrastructure

The Federal Bureau of Investigation (FBI) issued a FLASH report to disseminate indicators of compromise (IoCs) for the Funnull infrastructure that threat actors used to manage domains related to cryptocurrency investment fraud scams between October 2023 and April 2025. The report provided links to two lists. more

Framing the AkiraBot Framework Under the DNS Lens

SentinelLABS recently dug deep into AkiraBot, a framework made to spam website chats and contact forms to promote a low-quality search engine optimization (SEO) service. So far, the bot has targeted 400K+ websites and spammed 80K+ websites since September 2024. more

Shining the DNS Spotlight on Lumma Stealer

The U.S. Department of Justice seized 114 domains connected to a major information-stealing campaign utilizing Lumma Stealer on 21 May 2025. The Cybersecurity and Infrastructure Security Agency (CISA) released the list of indicators of compromise (IoCs) on the same date. more

A DNS Examination of the Phishing Campaign Targeting Japanese Brokerage Firms

Yahoo! News Japan reported cases where securities accounts were hijacked so cybercriminals could sell stocks without their rightful owners' permission. More than 3,500 fraudulent transactions have already been recorded from January to April 2025 alone, amounting to stock owner losses of ¥300+ billion. more

A DNS Deep Dive into the LabHost PhaaS Infrastructure

The Federal Bureau of Investigation (FBI) shared a warning on 29 April 2025 about the LabHost phishing-as-a-service (PhaaS) campaign that threatened the security of users worldwide, along with a massive list of related indicators of compromise (IoCs). WhoisXML API embarked on an in-depth analysis of the IoCs through a DNS deep dive. more

Radix Releases UA Readiness Study on E-Commerce Platforms to Support Broader Internet Compatibility

Adoption of new short and new long TLDs shows strong momentum, while IDN email compatibility continues to evolve across platforms. more

Addressing the Drop: IPv4 Prices Slide as Larger Blocks Come to Market

The market for IPv4 addresses continues to experience deflationary pressures, with recent data showing a steady decline in prices across all block sizes. According to May 2025 figures from IPv4.Global by Hilco Streambank, average prices per address have been trending downward for nearly a year, with large blocks - particularly /16s - leading the descent. more

New MITRE ATT&CK Groups for 2025: A DNS Deep Dive

The MITRE Corporation updates its list of groups on the ATT&CK page every six months, specifically in April and October each year. The Updates - April 2025 advisory listed seven new groups with corresponding lists of indicators of compromise (IoCs) listed in the References section. Take a look at specific IoC-related details for each group below. more

Exploring the DNS Flipside of SideWinder

The SideWinder advanced persistent threat (APT) group, active since 2012 and known for targeting government, military, and business entities throughout Asia, primarily Pakistan, China, Nepal, and Afghanistan, has struck once again. This time around, the threat actors updated their toolset and created new infrastructure to spread malware and control compromised systems. more

Global Domain Activity Trends Seen in Q1 2025

Based on our Q1 2025 ranking of the most popular gTLDs and ccTLDs, the same players pretty much made the list. The .com gTLD remained in first place while the other gTLD extensions like .xyz, .top, and .shop lagged far behind. Among the ccTLDs, only .de made it to the top 10. more