QakBot Malware IoC Analysis for 2026 | WhoisXML API
WhoisXML API identified hundreds of malicious artifacts connected to QakBot through IoC analysis. Download the threat research materials now.
Continue reading Download reportBeneath the Belly of the Latest BlueNoroff Attack: A DNS Investigation
The latest BlueNorroff attack used a malicious Zoom extension in the guise of a Calendly meeting invite from a supposed contact sent via Telegram. Instead of a Google Meet page as the link hinted, however, users ended up on a threat actor-controlled fake Zoom domain. That triggered the download of a malicious AppleScript whose final payload was the malware, a keylogger.1
The researchers identified four domains and three URLs as indicators of compromise (IoCs). We derived seven domains from the IoCs for further analysis. Our bid to uncover more potentially connected artifacts, led to the discovery of:
- Three domains tagged likely to turn malicious by First Watch Malicious Domains Data Feed 72–281 days prior to the attack’s discovery
- 16 email-connected domains
- Six IP addresses, all turned out to be malicious
- 13 IP-connected domains, one turned out to be malicious
- 21,617 string-connected domains, 95 turned out to be malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis