Cybercrime

Enriching Intrusion Detection and Prevention Systems with IP and Domain Intelligence

Intrusion detection systems (IDSs) and intrusion prevention systems (IPSs), collectively called "intrusion detection and prevention systems (IDPSs)," monitor network traffic to stave off unauthorized access. Roughly speaking, an IDS detects possible malicious network activities, while an IPS stops malicious traffic from entering and possibly damaging a network.

QAnon and 8Chan Digital Footprint Analysis and Investigation Expansion

In October, Brian Krebs reported that several websites related to 8Chan and QAnon went offline, albeit only briefly. That happened when the entity protecting them from distributed denial-of-service (DDoS) attacks, CNServers LLC, terminated its service to hundreds of Spartan Host IP addresses...

Attack Surface Discovery: A Review of FINRA-lookalike Domain and Linked IoCs

More recently, phishers used a Financial Industry Regulatory Authority (FINRA) look-alike domain in an attempt to breach several of its members' networks. Tasked to oversee 624,000 brokers in the U.S., attacking FINRA's clientele could yield a hefty sum should phishing email recipients fall for the ruse.

A Brief OSINT Analysis of Charming Kitten IoCs

Charming Kitten is a cybercriminal group believed to be of Iranian origin, which was first seen in 2014, but had been active for years after the initial detection. The group use an intricate web of methods such as spear phishing and impersonation.

Revisiting APT1 IoCs with DNS and Subdomain Intelligence

Cyber espionage is a type of cyber attack that aims to steal sensitive and often classified information to gain an advantage over a company or government. The 2020 Data Breach Investigations Report (DBIR) revealed that several hundreds of incidents across industries in the previous year were motivated by espionage.

How Much of a Fortune 500 Company’s Digital Footprint Can Be Publicly Attributed to It?

Not all of the domains that contain a company's brand are under its control. A portion of them - sometimes even the vast majority -- is typically registered by unidentifiable third parties with masked WHOIS records. Arguably, WHOIS redaction might also be preferred by the companies themselves for privacy purposes. But to which extent is this the case?

Business Email Compromise Attacks: The Big Phishing Scam That’s Easily Missed

Business email compromise (BEC) attacks are arguably the most sophisticated of all email phishing attacks, and some of the most costly. From 2016-2018, BEC alone made $5.3 billion, but it's not an attack that everyone is familiar with.

10 Common Digital Threats to Businesses

The year 2020 has created an increased impetus for change - especially as companies embrace digital transformation at an accelerated pace. Cybercriminals have also upped their game, switching their attention to hot targets such as healthcare and pharmaceutical brands.

Attack Surface Analysis: Most Blacklisted IP Addresses Scrutinized

The attack surface of every Internet user gets wider every day, but it doesn't mean there's nothing that can be done about it. For one, analyzing possible attack vectors, such as suspicious or malicious domain names and IP addresses, can help with attack surface management.

Third-Party Vendor Risk Management: A Look into Top Couriers’ Digital Footprint

Just as no man is an island, no company can perform core functions without other organizations' help. This fact is highlighted in today's age of outsourcing, partnership, and third-party connections. Unfortunately, threat actors have also found a massive opportunity in these relationships.