Industry

Tracing BlackNet RAT’s History through a DNS Deep Dive

BlackNet RAT, first discovered during the COVID -- 19 pandemic and being distributed via spam messages offering an effective cure for the virus, seems to have outlived the global crisis. more

Alleviating the Risks .zip and Similar Domain Extensions Could Pose via DNS Intelligence

Google's announcement of the launch of the .zip ngTLD was met by a lot of debate. Many believe threat actors could abuse the ngTLD for phishing and other malicious campaigns, primarily since it could be easily confused with the .zip file extension. more

Phisher Abusing .com TLD?

Phishing campaigns almost always require a massive volume of domains in order to succeed. Phishers, after all, need to have readily weaponizable vectors at their disposal in case the ones they're currently employing get detected and consequently blocked. more

DNS Revelations on Eevilcorp

Phishing, despite its age and infamy, remains one of the top threats to corporate and personal networks alike. And it's not hard to see why -- it continues to be effective. In fact, more than a third of all data breaches today involve phishing. more

AI Tool Popularity: An Opportunity for Launching Malicious Campaigns?

The latest fraud data Sift published in "Q2 2023 Digital Trust & Safety Index" revealed that 78% of users are concerned that fraudsters could exploit AI tools to victimize them. more

APT29 Goes from Targeted Attacks to Phishing via NOBELIUM: A DNS Deep Dive

APT29, believed to be an espionage group from Russia, became known for launching targeted attacks against organizations in Ukraine. But over the course of investigating the threat group, Mandiant discovered that it may have a hand in cybercriminal operations, specifically phishing, as well. more

A DNS Deep Dive into BreachForums Domains

The Federal Bureau of Investigation (FBI) shut down BreachForums, a forum for English-speaking black hat hackers, on 21 March 2023, following the arrest of its owner Conor Brian Fitzpatrick. more

Finding WyrmSpy and DragonEgg Ties to APT41 in the DNS

APT41, also known as "Winnti," "BARIUM," or "Double Dragon," is an APT group said to originate from China. Having been active since 2012, APT41 rose to infamy by successfully launching targeted cyber espionage attacks on government agencies and private companies worldwide. more

Signs of MuddyWater Developments Found in the DNS

Cyber espionage group MuddyWater's or Mercury's first major campaign was seen as early as 2012. But as things always go in the cybersecurity realm, threat groups, especially those that gain infamy, don't necessarily just come and go. more

CSC Launches Groundbreaking Domaincasting Digital Blocking Network

CSC, an enterprise-class domain registrar and world leader in mitigating domain and domain name system (DNS) threats, has launched its new Domaincasting^SM digital blocking network - a complement to its current Enforcement services. more

DNS Insights behind the JumpCloud Supply Chain Attack

Even solutions meant to enhance security can sometimes fall prey to the best cyber attackers. That's what happened to JumpCloud, a cloud-based directory service platform designed to centralize and simplify identity access management (IAM). more

New CSC Research Indicates Launch of Threads by Instagram is Already a Growing Target for Fraud and Brand Abuse

On July 5, 2023, Meta's Instagram released "Threads" -- an online social media and social networking service offering users the ability to post and share text, images, and videos, as well as interact with others and join public conversations through posts, replies, reposts, and likes. more

Dissecting 1M+ Malicious Domains Under the DNS Lens

Threat actors continue to abuse the DNS by weaponizing domain names. On 13 April 2023, through our recently launched Threat Intelligence Data Feeds (TIDF), we identified more than 1 million suspicious and malicious domains that figured in phishing, malware distribution, spam, and other cyber attacks, such as brute-force and distributed denial-of-service (DDoS) attacks. more

Phishing Group Found Abusing .top Domains

Threat researcher Dancho Danchev recently discovered a phishing operation that seemed to be abusing .top domains for which he collated 89 email addresses that served as indicators of compromise (IoCs).  more

Discovering Potential BEC Scam Vehicles Through the DNS

Threats tend to become more advanced over time. So is the case of business email compromise (BEC) scams, which according to a SlashNext post, cost companies billions of U.S. dollars in losses per year. more