Unraveling the DNS Connections of ToxicPanda
WhoisXML API found 830+ artifacts that could be connected to ToxicPanda. Download the threat research materials now.
Continue reading Download reportA DNS Investigation of the GootLoader Campaign
It’s one thing for a piece of malware to steal victims’ data. It gets worse, though, when that malware paves the way for even more sinister actions like dropping a ransomware or allowing further compromise without getting detected. That’s the case for GootLoader.1
Twelve domains have been tagged as GootLoader indicators of compromise (IoCs).2 The WhoisXML API expanded this list to uncover other connected artifacts and found:
- 33 email-connected domains
- 15 IP addresses, six of which turned out to be malicious
- 692 IP-connected domains
- 302 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
- [2] https://github.com/sophoslabs/IoCs/blob/master/gootloader_cats_iocs.csv