Hunting for TimbreStealer Malware Artifacts in the DNS
WhoisXML API found thousands of artifacts potentially connected to the newly detected TimbreStealer malware. Download the threat research materials now.
Continue reading Download reportConti Ransomware: Still Alive and Kicking
Despite the heightened lookout for key members of Wizard Spider given the huge reward offered by the U.S. government,1 Conti ransomware continues to plague individuals and businesses worldwide.
WhoisXML API threat researcher Dancho Danchev’s investigation, in fact, found:
- Nearly 30 known Wizard Spider gang members’ aliases or online handles
- 250+ email addresses belonging to the gang’s members
- 50+ domains that served as Conti ransomware hosts
- 500+ domains that pointed to Conti ransomware command-and-control (C&C) servers, a vast majority of which were registered in the U.S.
- 1,400+ IP address resolutions of the domains primarily geolocated in the U.S., 19% of which were tagged “malicious” by various malware engines
- 70+ domains that shared the C&C domains’ IP hosts, 9% of which were dubbed “malicious” by various malware engines
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.theregister.com/2022/05/09/us-reward-conti-ransomware/