Cyberattack

A DNS Deep Dive into FUNULL’s Triad Nexus

Silent Push has been monitoring the FUNULL content delivery network (CDN) for two years now. They believe the network has played host to various cybercriminal campaigns, including investment scams, fake trading app distribution, suspect gambling networks, and the Polyfill supply chain attack.

Uncovering Potential Black Friday and Thanksgiving Threats with DNS Data

Thanksgiving is right around the corner. With it, of course, come celebrations with family and friends and the biggest Black Friday sales. All seems well and good but that's not always the case, isn't it?

New RomCom Variant Spotted: A Comparative and Expansion Analysis of IoCs

The threat actors behind the RomCom malware, known for extorting government agencies, recently resurfaced with a new RomCom variant called "Snipbot" or "RomCom 5.0" by Palo Alto Networks Unit 42.

Global Domain Activity Trends Seen in Q3 2024

WhoisXML API analyzed close to 22 million domains registered in Q3 2024 to uncover global domain activity trends.

A DNS Investigation into Mamba, the Latest AitM Phishing Player

Phishing has been around for years, yet it still proves to be a major online threat. To continue profiting, cybercriminals must continuously adapt their techniques.

Examining the DNS Underbelly of the Voldemort Campaign

Toward the end of August 2024, a customized malware dubbed "Voldemort" based on strings found in its code was used in a cyber espionage campaign targeting various countries.

Stripping Down the BlackSuit Ransomware Network Aided by DNS Data

Nearly 1 million individuals' information was stolen and exposed when threat actors launched a BlackSuit ransomware attack on 10 April 2024. The investigation revealed that the compromised data included the victims' Social Security numbers (SSNs), birthdays, and insurance claim information.

A DNS Deep Dive into the NetSupport RAT Campaign

Remote access trojans (RATs) can be considered the malware of choice by the world's most notorious advanced persistent threat (APT) groups. And there's a good reason for that. They are hard to detect, making them ideal for lateral movement, and also difficult to get rid of.

Tracking the DNS Footprint of the Polyfill Supply Chain Attackers

Threat actors can often find targeting certain organizations too much of a challenge. So they need to go through what we can consider back channels -- suppliers, vendors, or service providers.

Study by WhoisXML API Explores IDNs, Native-Language Characters, and Homograph Attacks

While the usage of internationalized domain names (IDNs) has allowed organizations the world over to enter the global market using their native-language domain names, it can also enable cyber attackers to craft look-alikes of legitimate domains they wish to spoof.