Exploring the SideWinder APT Group’s DNS Footprint
WhoisXML API found 570+ artifacts that could be connected to the SideWinder APT group. Download the threat research materials now.
Continue reading Download reportDNS Snooping on Apple iOS 14 Zero-Click Spyware KingsPawn
The NSO Group’s Pegasus malware blazed the trail for what we know now as zero-click spyware targeting mobile OSs, including Apple's iOS, for government use last year. They made such a splash that just last April, new spyware market player QuaDream released what we could consider Pegasus’s relative—KingsPawn.
Meanwhile, Microsoft published an in-depth study of KingsPawn where they named 64 domains as indicators of compromise (IoCs).
We scoured the DNS for other potentially KingsPawn-related artifacts and found:
- 19 IP addresses to which the IoCs resolved, 17 of which turned out to be malicious
- 2,100+ additional domains that shared the IoCs’ IP hosts, 11 of which turned out to be malware hosts
- 1,000+ subdomains that contained the string com.apple, 18 of which have been categorized as malicious
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/