DNS Spotlight: Rockstar2FA Shuts Down, FlowerStorm Starts Up
WhoisXML API found 1,340+ artifacts that could be connected to FlowerStorm. Download the threat research materials now.
Continue reading Download reportDNS Deep Dive: Peeking into Back Doors to Abandoned but Live Backdoors
Backdoors allow threat actors to bypass a target organization’s normal authentication mechanisms.1 Most of these malware steal sensitive information and send it to command-and-control (C&C) servers—domains under the attackers’ control.
Did you ever wonder what happens to domains that served as C&C servers? Many of them remain operational and can be accessed by other threat actors.2
Security researchers recently identified 34 domains as indicators of compromise (IoCs) for such a threat.3 The WhoisXML API research team expanded that list and uncovered 1,360+ connected artifacts comprising:
- 498 email-connected domains
- 10 IP addresses, eight of which turned out to be malicious
- 192 IP-connected domains
- 666 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/what-is-a-backdoor-attack/
- [2] https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/
- [3] https://otx.alienvault.com/pulse/677fedbe255c99f3fe95d33e