Domain Shadowing IoC Expansion Led to Thousands of Possible Connections
Threat actors have been known to hide behind legitimate Internet services1 to spread malware and lure victims to phishing sites and other malicious campaigns.
In this study, we built on a Palo Alto Networks report2 to dig deeper into a tactic called “domain shadowing” that enables cybercriminals to ride on the legitimacy of an entity’s domain name. The study led us to:
- 2,900+ new subdomains beginning with strings used in the IoCs added between 1 September and 24 October 2022
- 1,600+ web properties sharing the same IP addresses as the IoCs
- About 4% of the connected artifacts that have been flagged as malicious
- Several properties hosting suspicious pages, some of which look similar to content hosted by the IoCs
Get access to our findings and uncover more on your own. Download the report now.
—
- [1] https://main.whoisxmlapi.com/threat-reports/gallium-apt-group-and-other-threat-actors-have-in-disguise
- [2] https://unit42.paloaltonetworks.com/domain-shadowing/#post-125143-_wkwf346ho2ji
Latest Reports
Integrity Technology Group-Backed Actors Combine Automated and Manual Tools in Global Attack
WhoisXML API uncovered 7,100+ additional artifacts linked to the Integrity Tech-enabled global data theft attack. Download the threat research materials now.
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.