WhoisXML API uncovered 62,081 domains referencing the 2026 U.S. midterm elections, including look-alike candidate stores traced to a few registrants. Download the threat research materials now.
Continue readingCOLDRIVER’s MAYBEROBOT in the DNS Spotlight
The Google Threat Intelligence Group (GTIG) recently analyzed the evolution of Russia-affiliated threat group COLDRIVER’s homegrown malware NOROBOT. The tool has been redesigned into YESROBOT and now into MAYBEROBOT.1
GTIG identified 14 indicators of compromise (IoCs) comprising 13 domains and one IP address related to the threat. WhoisXML API dove deeper into the IoCs and uncovered these findings:
- Four of the domain IoCs were deemed likely to turn malicious 127–182 days before they were reported as such
- One email-connected domain
- Four additional IP addresses, all were malicious
- Five IP-connected domains, two were malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver/