Cybersecurity

3 Russian Threat Groups Target Persons of Interest

A DNS investigation into indicators linked to three Russian threat groups uncovered potentially victim-owned IP addresses and thousands of connected domains, including infrastructure already associated with malicious activity.

DNS Footprinting: SourTrade Distributes Unfinished Malware through Malvertising

DNS analysis of 96 SourTrade domains uncovered hundreds of connected domains and IP addresses, many flagged as malicious, while identifying indicators that appeared months before researchers formally linked them to the malvertising campaign.

DNS Spotlight: 2026’s 5 Most Notorious Ransomware

DNS analysis of 84 network indicators tied to LockBit, Cl0p, Akira, Medusa, and Qilin uncovered thousands of connected domains and IP addresses, including additional artifacts already identified as malicious.

A DNS Infrastructure Analysis of a Microsoft 365 Device Code Phishing Campaign

A DNS investigation into a Microsoft 365 device code phishing campaign uncovered coordinated, disposable infrastructure, including 290 indicators of compromise, 87 malicious IP addresses and hundreds of connected domains, suggesting the operation remains active.

5 of the Biggest Cyber Attacks in 2026 So Far: DNS Deep Dive

A DNS deep dive into five major cyber attacks of 2026 uncovers infrastructure linked to Cisco, Ivanti, Stryker and ShinyHunters incidents, revealing hundreds of connected domains and IP addresses that could sharpen threat detection efforts.

Massive Photo ZIP Campaign Targets Booking.com Partner and Other Hotels across Japan and Europe

A sprawling phishing campaign targeting hotels in Japan and Europe used deceptive photo ZIP files and legitimate web services to establish persistent access, while researchers uncovered thousands of potentially connected infrastructure artifacts and victim IP addresses.

Global Domain Activity Trends Seen in Q2 2026

WhoisXML API's Q2 2026 analysis reveals rising domain registrations, shifting TLD rankings, growing DNS infrastructure concentration, and evolving malicious domain activity, based on billions of DNS records and millions of newly registered and confirmed malicious domains.

APT37 Strikes Again, This Time with NarwhalRAT

North Korea's APT37 has launched a new NarwhalRAT campaign using spearphishing emails and malicious LNK files to deploy data-stealing malware. Researchers also uncovered infrastructure links and fresh indicators that expand the group's known operational footprint.

A DNS Investigation of LenAI’s ErrTraffic ClickFix Distribution Network

An analysis of LenAI's ErrTraffic ClickFix infrastructure uncovered new DNS links, exposing malicious domains, IPs, typosquatting clusters, and email connections that broaden threat visibility and support stronger detection and incident response through expanded network intelligence.

Inside a TDS-Powered ClickFix Malware Ecosystem: A DNS Deep Dive

DNS analysis of a malware distribution ecosystem uncovered thousands of linked artifacts, exposing typosquatting, malicious infrastructure and victim connections that broaden detection opportunities beyond Check Point Research's original indicators through expanded DNS intelligence correlation efforts.