COLDRIVER’s MAYBEROBOT in the DNS Spotlight

The Google Threat Intelligence Group (GTIG) recently analyzed the evolution of Russia-affiliated threat group COLDRIVER’s homegrown malware NOROBOT. The tool has been redesigned into YESROBOT and now into MAYBEROBOT.¹

GTIG identified 14 indicators of compromise (IoCs) comprising 13 domains and one IP address related to the threat. WhoisXML API dove deeper into the IoCs and uncovered these findings:

• Four of the domain IoCs were deemed likely to turn malicious 127–182 days before they were reported as such
• One email-connected domain
• Four additional IP addresses, all were malicious
• Five IP-connected domains, two were malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/