A DNS Investigation of the GootLoader Campaign
WhoisXML API found 1,000+ artifacts that could be connected to the GootLoader campaign. Download the threat research materials now.
Continue reading Download reportDIY Web Attacks Might Still Live on via WebAttacker
WebAttacker can be considered an aged threat, but it may not be out of the cybercrime game just yet.1 While it has been in business since 2006, what WhoisXML API threat researcher Dancho Danchev discovered recently seems to indicate its operators could still be up to no good.
From three email addresses belonging to the WebAttacker operators, our deep dive into the threat uncovered these findings.
- Close to 350 domains were registered using the email addresses identified as indicators of compromise (IoCs).
- The domains registered with the email addresses were created between 2011 and 2022.
- The domains resolved to more than 130 IP addresses.
- The IP addresses were spread out across over a dozen countries.
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.csee.umbc.edu/courses/undergraduate/CMSC491malware/wp-evolution-of-exploit-kits.pdf