Picus Security, in Red Report 2026, identified the top 10 MITRE ATT&CK techniques in 2025 and named some of the groups that employed them. We zoomed in on 11 attacks featured in their report for six of the 10 ATT&CK techniques with their corresponding subtechniques where applicable in hopes of gathering more insights and collating additional artifacts.

We obtained a total of 147 network IoCs from the abovementioned 11 analyses referenced in the report.

We analyzed the IoCs further, which led to these discoveries:

• 616 unique client IP addresses communicated with five domains identified as IoCs
• 23 domains classified as IoCs were bulk-registered with 2—936 look-alike domains each
• 28 domains tagged as IoCs deemed likely to turn malicious 46—516 days before they were reported as such
• Three unique potential victim IP addresses communicated with two IP addresses named as IoCs
• 7,770 email-connected domains, 25 were confirmed malicious
• 56 additional IP addresses, 46 were confirmed malicious
• 186 IP-connected domains, 143 were confirmed malicious
• 2,106 string-connected domains, two were confirmed malicious

A sample of the additional artifacts obtained from our analysis is available for download from our website.

More DNS Insights on the Subdomain IoCs

We began our analysis by looking for more information about the 26 subdomains identified as IoCs for seven of the 11 attacks via the WhoisXML API MCP Server.

We determined that while many of them were considered either benign or inactive, five have been confirmed as malicious—four related to Earth Ammit and one to Earth Alux.

Additional DNS Facts Related to the Domain IoCs

As our next step, we sought out more details about the 104 domains identified as IoCs for the 11 threats.

Sample network traffic data from the IASC, for one, revealed that 616 unique client IP addresses under a single ASN communicated with five of the domains tagged as IoCs via a total of 4,138 DNS queries made between 21 January and 19 February 2026.

We sought to find out if any of the 104 domains named as IoCs appeared in the Typosquatting Data Feed and discovered that 23 were part of 24 typosquatting domain groups. Each was bulk-registered with 2—936 look-alikes between 4 January 2024 and 20 September 2025.

The results of our First Watch Malicious Domains Data Feed searches, meanwhile, showed that 28 of the domains categorized as IoCs for five threats could have been registered with malicious intent from the get-go. In fact, they were deemed likely to turn malicious 46—516 days before they were reported as IoCs. Take a look at more details for a domain related to each threat below.

We then queried the 104 domains classified as IoCs on WHOIS API and discovered that:

• They were created between 1 January 2015 and 9 February 2026, hinting at the threat actors’ possible lack of preference in terms of domain age.

  

• They were administered by 29 different registrars.

  

• While 20 did not have registrant countries on record, the remaining 84 domains were registered in 15 different countries.

  

We also queried the 104 domains dubbed as IoCs on DNS Chronicle API and found out that 101 related to 10 threats have recorded 5,823 domain-to-IP resolutions over time. Here are details on a domain related to each threat.

Further DNS Discoveries about the IP IoCs

Next, we scoured the DNS for more information about the 17 IP addresses identified as IoCs for eight threats.

Sample network data from the IASC, for instance, revealed that three unique potential victim IP addresses under three distinct ASNs communicated with two IP addresses tagged as IoCs between 21 January and 19 February 2026.

We then queried them on Bulk IP Geolocation Lookup and discovered that:

• They were geolocated in 10 countries. Note that five of them—China, France, Germany, Japan, and the U.S.—were also among the list of registrant countries of the domains classified as IoCs.

  

• While one did not have an ISP on record, the remaining 16 were administered by 12 ISPs.

  

DNS Chronicle API queries for the 17 IP addresses named as IoCs showed that 16 IPs related to eight threats recorded 1,842 IP-to-domain resolutions over time. Take a look at more information on an IP address related to each threat below.

Additional Threat Artifacts Unearthed

After gathering more details about the IoCs, we then scoured the DNS for additional connected artifacts.

First, we queried the 104 domains identified as IoCs on WHOIS History API and found out that 58 had 125 unique email addresses in their historical WHOIS records. Careful scrutiny allowed us to discern that 28 were public email addresses.

Reverse WHOIS API queries for the 28 public email addresses revealed that four could belong to domainers. This step also led to the discovery of 7,770 unique email-connected domains after those already listed as IoCs were filtered out.

According to Threat Intelligence API, 25 email-connected domains have already been weaponized for various threats.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.