Cybersecurity

Mining for DNS Maxims: Top 10 Malware of Q3 2025

An analysis of domains linked to the top malware strains of Q3 2025 reveals early threat signals, typosquatting patterns, and thousands of connections to malicious infrastructure, underscoring the predictive power of DNS telemetry.

Thumbing Through the DNS Traces of TamperedChef

Acronis researchers uncovered a vast malvertising scheme named TamperedChef, which exploited legitimate-looking apps to deploy malicious scripts, steal data, sell remote access, and lay the groundwork for espionage and ransomware campaigns.

DNS Spotlight: New MITRE ATT&CK Group Entrants as of October 2025

MITRE introduced nine new threat groups tied to major vulnerabilities, with deep DNS analysis uncovering 108 malicious domains, 31 risky IPs, and multiple emerging artifacts that highlight evolving attack patterns and early warning opportunities ahead.

A New DNS Validation Method for Simplified Certificate Automation

A new DNS-based domain validation method promises to streamline certificate automation by reducing DNS write requirements, improving operational security, and aligning with broader industry moves toward scalable, standards-based certificate management.

Hard Data on DDoS, DNS, and the Race for Resilience

As online attacks grow in complexity and scale, DigiCert's RADAR Brief reveals why resilience across DNS, DDoS, and automation is emerging as the defining metric of digital trust in a hyperconnected economy.

Going DNS Deep Diving Into GhostCall and GhostHire

A DNS investigation into GhostCall and GhostHire uncovers how BlueNoroff targeted tech leaders and Web3 developers, exposing extensive data theft and a wide malicious infrastructure that included suspicious domains, weaponized IP addresses, and typosquatted assets.

COLDRIVER’s MAYBEROBOT in the DNS Spotlight

Russia-linked threat actor COLDRIVER has revamped its malware into a new backdoor called MAYBEROBOT, targeting NGOs and dissidents. Early DNS signals and IP resolutions reveal a methodically evolving cyber-espionage campaign.

Burrowing Into the Beamglea Campaign DNS Infrastructure

A threat campaign known as Beamglea exploited npm packages to target over 135 companies globally. Researchers uncovered 175 malicious packages, 344 related domains, and dozens of IP-linked artifacts through DNS and WHOIS analysis.

Chasing After RacoonO365 IoCs Using DNS and Domain Intelligence

A coordinated crackdown on RaccoonO365 reveals the scale of phishing-as-a-service operations, as domain and DNS data expose hundreds of linked artifacts and offer a window into the infrastructure of low-skill cybercrime.

Spelunking Into SVG Phishing: Amatera Stealer and PureMiner DNS Deep Dive

Cybercriminals are swapping standard image formats for SVG files to smuggle malware into systems. A detailed investigation uncovered a sprawling network of suspicious domains, IP addresses, and email-linked infrastructure used for espionage and cryptojacking.