A DNS Investigation of the GootLoader Campaign
WhoisXML API found 1,000+ artifacts that could be connected to the GootLoader campaign. Download the threat research materials now.
Continue reading Download reportDNS Insights behind the JumpCloud Supply Chain Attack
Cybersecurity has become a must to every organization given the proliferation of attacks. It’s quite ironic then when even the solutions we use to protect our systems and identities get exploited.
Researchers recently uncovered supply chain attacks targeting identity access management (IAM) platform JumpCloud.1 A total of 32 IoCs related to the threat have been identified.
To make the Internet safer and more transparent, WhoisXML API took a closer look at the JumpCloud supply chain attack IoCs via a DNS deep dive and identified more artifacts, namely:
- 145 domains that shared some of the dedicated IP hosts identified as IoCs, one of which has been dubbed malicious based on a bulk malware check
- 392 domains that contained the strings centos, datadog, and zscaler akin to some of the domains identified as IoCs
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://securityaffairs.com/148680/apt/north-korea-jumpcloud-attack.html
- [2] https://jumpcloud.com/support/july-2023-iocs