Industry

Probing an Active Digital Trail of Iranian Hackers

WhoisXML API threat researcher Dancho Danchev obtained a publicly accessible list of email addresses known to be owned and used by Iranian hackers. The email addresses led us to more than 4,400 domain names, any of which can be weaponized and used in phishing, credential theft, and other forms of cyber attacks. more

Who Could Be Behind the Latest GitHub-Hosted Malware Infrastructure?

GitHub is a popular code repository used by almost all software developers. Anyone can access it to share their code with practically anyone interested. Unfortunately, not every GitHub user is trustworthy. It has, in fact, been used to host malware at least a couple of times. more

Should We Consider the Maze Ransomware Extinct?

The Maze Ransomware Group is one of the most notorious threat actor groups targeting large enterprises, such as Cognizant, Xerox, and Canon, and stealing massive amounts of sensitive data. Some of their ransomware distribution methods include spamming, phishing, and brute forcing. more

Tracing the Digital Footprint of Iran’s Mabna Hackers

In 2018, nine Mabna hackers were indicted by a U.S. grand jury for their involvement in different instances of cybercrime. Their victims included about 320 universities and over 50 private, government, and nongovernmental organizations in several countries. more

Verisign Domain Name Industry Brief: 351.5 Million Domain Name Registrations in Q2 2022

Today, we released the latest issue of The Domain Name Industry Brief, which shows that the second quarter of 2022 closed with 351.5 million domain name registrations across all top-level domains, an increase of 1.0 million domain name registrations, or 0.3%, compared to the first quarter of 2022. more

Profiling the Massive Infrastructure Behind the Democratic National Committee Cyberintrusion

The Democratic National Committee (DNC) breach was a high-profile cyber attack in recent history. Years later, the cybersecurity community can still benefit from insights and actionable intelligence relevant to the attack. In line with this, WhoisXML API threat researcher Dancho Danchev dove deep into the DNS system intrusion using publicly available indicators of compromise (IoCs). We further enriched his findings, allowing us to uncover: more

Is Your Software a Top Impersonation Target?

Anything conveniently obtainable online is often ripe for cybercriminal picking, and that's certainly true for the most commonly used software. We can't live without them, after all, if we are to thrive and not just survive in the digital world. more

Brand Registry Group .brand Brief, ICANN75

The Brand Registry Group (BRG) is the global association of companies and organizations working together to champion the use of .brand top-level domains and includes some of the world's most recognized consumer and B2B brands. more

XCSSET Shows How Threat Actors Cope with OS Changes, Does Away with Python Like macOS

Just as software and hardware vendors push upgrades and updates for their products and services to stay secure against the latest threats, so do threat actors work as fast as possible to stay abreast of OS and version modifications. That's exactly what the XCSSET malware operators have done for their campaigns targeting macOS users to continue working. more

Radix Turns 10, Celebrates With We Are X Campaign

Radix, the largest portfolio nTLD Registry with over 5.5 million domains under management, marked its 10th anniversary last week by launching a celebratory campaign, We Are X, at NamesCon 2022. Launched in 2012, Radix has seen a staggering 216% revenue growth in the last five years alone. more

DIY Web Attacks Might Still Live on via WebAttacker

Age is rarely an issue when it comes to malware campaigns, and that's certainly true for WebAttacker. WebAttacker is a do-it-yourself (DIY) malware creation kit that became popular back in 2006. It was the first exploit kit made available to cybercriminals in the Russian underground market for as little as US$20. more

Exposing a Currently Active Ashiyane Digital Security Domain Infrastructure

The infamous gray hat security company Ashiyane Digital Security Team has gone back online in 2021. At that time, WhoisXML API threat researcher Dancho Danchev exposed more than 100 domains belonging to the group. This analysis was recently expanded to further explore the Iran-based threat group's Internet-connected infrastructure. more