MITRE has named nine new groups, responsible for attacks related to the most abused vulnerabilities from August to October 2025. They identified six Enterprise groups, two Mobile groups, and one ICS group.

We compiled 126 domains as IoCs for five groups—AppleJeus, Contagious Interview, Storm-0501, Water Galura, and Star Blizzard. However, upon further checking via the WhoisXML API MCP Server, only 108 of the domains identified as IoCs were deemed suspicious or outright malicious. Take a look at more details below.

We limited our investigation to these domains, along with the 31 IP addresses tagged as IoCs for four groups (UNC3886, Water Galura, MuddyWater, and the Lazarus Group) and five email addresses for the Medusa Group.

Our in-depth analysis led to these discoveries:

• 1,839 unique potential victim IP addresses communicated with four distinct IP addresses identified as IoCs
• Two domains tagged as IoCs were deemed likely to turn malicious 10 days before they were reported as such
• 78 email-connected domains, 11 were found malicious
• Eight additional IP addresses, seven were found malicious
• 196 IP-connected domains, five were found malicious
• 718 string-connected domains, 11 were found malicious

A sample of the additional artifacts obtained from our analysis is available for download from our website.

A Closer Look at the IoCs

We began our investigation by looking more closely at the 108 domains, 31 IP addresses, and five email addresses identified as IoCs. Here are more details on the number of IoCs per group.

First, we consulted First Watch Malicious Domains Data Feed, to determine if any of the 108 domains identified as IoCs were deemed likely to turn malicious upon registration. Two domains connected to Contagious Interview appeared on the feed 10 days before being dubbed as IoCs. Take a look at more details below.

Next, we queried the 108 domains identified as IoCs on WHOIS API, and Domain Info API, and found out that:

• They were created between 11 August 2019 and 6 November 2025. Specifically, 35 domains were created in 2024, 28 in 2022, 19 in 2021, 13 in 2025, nine in 2023, three in 2019, and one in 2020. Here is a domain volume breakdown by group.

  

• They were split among 23 registrars topped by Namecheap, which accounted for 36 domains. Enom took second place with 14 domains, followed by Reg.ru with 13. Take a look at the breakdown by group below.

  

• While eight domains did not have registrant countries on record, the remaining 100 were registered in 12 countries. The top 3 countries were the U.S. with 49 domains, Iceland with 26, and the U.K. with six. Here is a detailed breakdown per group.

  

A DNS Chronicle API, query for the 108 domains identified as IoCs showed that 97 had historical domain-to-IP resolutions. Together, they posted 2,022 resolutions over time starting on 5 February 2017 (i.e., recorded for Star Blizzard IoC cloud-docs[.]com). Take a look at more information for five examples below.

We then zoomed in on the 31 IP addresses identified as IoCs. Sample network traffic data from the IASC, revealed that from 9 September to 13 November 2025, 1,839 unique potential victim IP addresses communicated with four of them.

The 1,839 IP addresses fell under 25 ASNs according to the results of a Bulk IP Geolocation Lookup, query.

Next, we queried the 31 IP addresses identified as IoCs on Bulk IP Geolocation Lookup and found out that:

• They were scattered across 15 countries led by Singapore, which accounted for eight IP addresses. The U.S. came in second place with seven IP addresses. Germany completed the top 3 with three IP addresses. Take a look at a detailed breakdown by group below.

  

• While three IP addresses did not have ISPs on record, the remaining 28 were administered by 21 ISPs. The top ISPs were Hetzner Online and MYRepublic Singapore, which tied in first place, accounting for three IP addresses each. Here is a volume breakdown by group.

  

A DNS Chronicle API query for the 31 IP addresses identified as IoCs revealed that 19 had historical IP-to-domain resolutions. In sum, they recorded 5,451 resolutions starting on 4 February 2017. Take a look at five examples below.

After that, we zoomed in on the five email addresses identified as IoCs. Jake AI, checks using the prompt “What can you tell me about [email IoC]?”

The results showed that while all five email addresses were valid, none seem to be currently active nor were used to register any domains. Take a look at the specifics below.

Given the details above, from here on out, the five email addresses identified as IoCs will not figure in the rest of our analysis.

The Hunt for New Artifacts

After learning more about the IoCs, we sought to uncover new artifacts connected to the featured groups. We first queried the 108 domains identified as IoCs on WHOIS History API, and discovered that 50 had email addresses in their historical WHOIS records. We found 191 unique email addresses in all.

Upon closer examination, we identified 18 public email addresses. We queried them on Reverse WHOIS API, and found out that while none of them appeared in current WHOIS records, 11 did show up on historical WHOIS records. We were, in fact, able to gather 78 email-connected domains after duplicates and those already tagged as IoCs were filtered out.

Threat Intelligence API, queries for the 78 email-connected domains revealed that 11 have already figured in various attacks. Here are five examples.

Next, we queried the 108 domains identified as IoCs on DNS Lookup API. We learned that 12 had active IP resolutions. Further scrutiny unveiled eight IP addresses after duplicates and those already tagged as IoCs were filtered out.

A Threat Intelligence API query for the eight additional IP addresses revealed that seven have already been weaponized for attacks.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website, or contact us, to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.