<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">

	<channel>

	<title>&#45; CircleID</title>
	<link>https://www.circleid.com/blogs/</link>
	<description>Postings from  on CircleID</description>
	<dc:language>en</dc:language>
	<dc:rights>Copyright 2026, unless where otherwise noted.</dc:rights>
	<dc:date>2026-03-12T16:35:00+00:00</dc:date>

	
	<item>
		<title> Looking for More Signs of Nitrogen in the DNS (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20240517-looking-for-more-signs-of-nitrogen-in-the-dns</guid>
		<link>https://circleid.com/posts20240517-looking-for-more-signs-of-nitrogen-in-the-dns</link>
		<description><![CDATA[Malwarebytes Labs recently published a report on the latest Nitrogen malware campaign that has been targeting system administrators using fake ads in the guise of Google sponsored search results. According to the security analysts, the victims are currently limited to North America. <a href="https://circleid.com/posts20240517-looking-for-more-signs-of-nitrogen-in-the-dns">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Digging Deep to Examine the Roots of the Glupteba UEFI Bootkit (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20240425-digging-deep-to-examine-the-roots-of-the-glupteba-uefi-bootkit</guid>
		<link>https://circleid.com/posts20240425-digging-deep-to-examine-the-roots-of-the-glupteba-uefi-bootkit</link>
		<description><![CDATA[Glupteba, an advanced piece of malware, has been used in several cybercriminal attacks for more than a decade now. But Palo Alto's Unit 42 only brought to light one of the features that made it so effective - its Unified Extensible Firmware Interface (UEFI) bootkit component, which allowed it to intervene and control the operating system (OS) boot process and be extremely difficult to detect and remove, last November 2023. <a href="https://circleid.com/posts20240425-digging-deep-to-examine-the-roots-of-the-glupteba-uefi-bootkit">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> DarkGate RAT Comes into the DNS Spotlight (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20240308-darkgate-rat-comes-into-the-dns-spotlight</guid>
		<link>https://circleid.com/posts20240308-darkgate-rat-comes-into-the-dns-spotlight</link>
		<description><![CDATA[In the past, DarkGate attacks were either lumped together with or classified as BattleRoyal remote access Trojan (RAT) attacks. Recent evidence, however, showed the two malware are not one and the same. <a href="https://circleid.com/posts20240308-darkgate-rat-comes-into-the-dns-spotlight">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Tracing the DNS Spills of the OilRig Cyber Espionage Group (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20240216-tracing-the-dns-spills-of-the-oilrig-cyber-espionage-group</guid>
		<link>https://circleid.com/posts20240216-tracing-the-dns-spills-of-the-oilrig-cyber-espionage-group</link>
		<description><![CDATA[The OilRig cyber espionage group that goes by many names, including APT34, Crambus, Lyceum, and Siamesekitten, launched a long-term intrusion against a Middle Eastern government agency that ran from February to September 2023. <a href="https://circleid.com/posts20240216-tracing-the-dns-spills-of-the-oilrig-cyber-espionage-group">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> A Log4Shell Malware Campaign in the DNS Spotlight (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20240110-a-log4shell-malware-campaign-in-the-dns-spotlight</guid>
		<link>https://circleid.com/posts20240110-a-log4shell-malware-campaign-in-the-dns-spotlight</link>
		<description><![CDATA[The Log4Shell zero-day vulnerability, also known as "CVE -- 2021 -- 44228," proved to be one of the worst bugs disclosed in December 2021. And while a patch for it has been made available via the Log4j 2.17.1 release seven days after its discovery, some affected systems could remain vulnerable to date. <a href="https://circleid.com/posts20240110-a-log4shell-malware-campaign-in-the-dns-spotlight">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Signs of Ongoing RedLine Stealer Operation Found Through a DNS Deep Dive (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20231208-signs-of-ongoing-redline-stealer-operation-found-through-a-dns-deep-dive</guid>
		<link>https://circleid.com/posts20231208-signs-of-ongoing-redline-stealer-operation-found-through-a-dns-deep-dive</link>
		<description><![CDATA[RedLine Stealer seems to have stolen cybercriminals' hearts as its usage has continued despite cybersecurity efforts to thwart it. Researchers have published reports about the stealer in the past, but its operators may have updated their arsenal with new domains and IP addresses to evade detection and consequent mitigation. <a href="https://circleid.com/posts20231208-signs-of-ongoing-redline-stealer-operation-found-through-a-dns-deep-dive">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Phisher Abusing .com TLD? (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20231108-phisher-abusing-.com-tld</guid>
		<link>https://circleid.com/posts20231108-phisher-abusing-.com-tld</link>
		<description><![CDATA[Phishing campaigns almost always require a massive volume of domains in order to succeed. Phishers, after all, need to have readily weaponizable vectors at their disposal in case the ones they're currently employing get detected and consequently blocked. <a href="https://circleid.com/posts20231108-phisher-abusing-.com-tld">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Hot on the DNS Trail of the 16shop Phishing Kit Operators (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20231009-hot-on-the-dns-trail-of-the-16shop-phishing-kit-operators</guid>
		<link>https://circleid.com/posts20231009-hot-on-the-dns-trail-of-the-16shop-phishing-kit-operators</link>
		<description><![CDATA[Phishers the world over have been patronizing and utilizing the 16shop phishing kit since at least 2018. The kit's users have been known to steal data and money from the customers of some of today's biggest brands, including Amazon, American Express, and PayPal. <a href="https://circleid.com/posts20231009-hot-on-the-dns-trail-of-the-16shop-phishing-kit-operators">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> RedHotel Attack Infrastructure: A DNS Deep Dive (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20230911-redhotel-attack-infrastructure-a-dns-deep-dive</guid>
		<link>https://circleid.com/posts20230911-redhotel-attack-infrastructure-a-dns-deep-dive</link>
		<description><![CDATA[We began our analysis by subjecting the domains identified as IoCs to Threat Intelligence Platform (TIP) lookups. Those allowed us to uncover these WHOIS record findings. <a href="https://circleid.com/posts20230911-redhotel-attack-infrastructure-a-dns-deep-dive">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Tracing Truebot's Roots through a DNS Deep Dive (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20230705-tracing-truebots-roots-through-a-dns-deep-dive</guid>
		<link>https://circleid.com/posts20230705-tracing-truebots-roots-through-a-dns-deep-dive</link>
		<description><![CDATA[On 12 June, the DFIR Report published an in-depth analysis of a Truebot intrusion that began with several page redirects via a Traffic Distribution System (TDS) and ended with dropping a Master Boot Record (MBR) killer wiper onto a victim's computer. The result? <a href="https://circleid.com/posts20230705-tracing-truebots-roots-through-a-dns-deep-dive">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Potential Traces of Aurora Spread Via Windows Security Update Malvertisements in the DNS (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20230613-potential-traces-of-aurora-spread-via-windows-security-update-malvertisements-in-the-dns</guid>
		<link>https://circleid.com/posts20230613-potential-traces-of-aurora-spread-via-windows-security-update-malvertisements-in-the-dns</link>
		<description><![CDATA[Threat actors are quite adept at changing tactics once the cybersecurity community or law enforcement catches up to them. That is evident in the recent resurgence of malvertising though no longer through users' browsers as in the past. <a href="https://circleid.com/posts20230613-potential-traces-of-aurora-spread-via-windows-security-update-malvertisements-in-the-dns">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Uncovering Stolen Card E-Shops Using DNS Intelligence (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/postsuncovering-stolen-card-e-shops-using-dns-intelligence</guid>
		<link>https://circleid.com/postsuncovering-stolen-card-e-shops-using-dns-intelligence</link>
		<description><![CDATA[Ever wondered where the personally identifiable information (PII) phishers steal from victims end up? More likely than not, they're put up for sale on the ever-growing number of online stolen card shops. <a href="https://circleid.com/postsuncovering-stolen-card-e-shops-using-dns-intelligence">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Gauging the Scale of an Active Ransomware Gang's Infrastructure (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20230403-gauging-the-scale-of-an-active-ransomware-gangs-infrastructure</guid>
		<link>https://circleid.com/posts20230403-gauging-the-scale-of-an-active-ransomware-gangs-infrastructure</link>
		<description><![CDATA[Ransomware gangs are now a dime a dozen. But in reality, victims rarely engage directly with their members. They are, in fact, more likely communicating with what the cybersecurity community has dubbed "ransomware affiliates" who earn as much as 75% of the ransom payment. <a href="https://circleid.com/posts20230403-gauging-the-scale-of-an-active-ransomware-gangs-infrastructure">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Profiling a Massive Portfolio of Domains Involved in Ransomware Campaigns (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20230314-profiling-a-massive-portfolio-of-domains-involved-in-ransomware-campaigns</guid>
		<link>https://circleid.com/posts20230314-profiling-a-massive-portfolio-of-domains-involved-in-ransomware-campaigns</link>
		<description><![CDATA[Security researcher Dancho Danchev discovered a portfolio of domains and IP addresses used by known threat actors in ransomware campaigns. The said portfolio consists of 62,763 domain names and 810 IP addresses. We analyzed a sample of these malicious properties using TIP and found that: <a href="https://circleid.com/posts20230314-profiling-a-massive-portfolio-of-domains-involved-in-ransomware-campaigns">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	
	<item>
		<title> From Data Breach to Phishing to Lapsus$: Cyber Attacks That Echoed in 2022 (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20230116-from-data-breach-to-phishing-to-lapsus-cyber-attacks-that-echoed-in-2022</guid>
		<link>https://circleid.com/posts20230116-from-data-breach-to-phishing-to-lapsus-cyber-attacks-that-echoed-in-2022</link>
		<description><![CDATA[As a New Year treat, Threat Intelligence Platform (TIP) researchers decided to look back at some of the most newsworthy cybersecurity incidents in 2022 - the Revolut Data Breach, the series of attacks launched by Lapsus$, and a newly detected PayPal phishing tactic. <a href="https://circleid.com/posts20230116-from-data-breach-to-phishing-to-lapsus-cyber-attacks-that-echoed-in-2022">More...</a>]]></description>
		<dc:date>2026-03-12T09:35:00-07:00</dc:date>
	</item>
	

	</channel>
</rss>