Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
TrendAI Research¹ traced four years of spearphishing against Ukrainian government agencies, defense organizations, border guard units, and logistics operators. They attribute it to Earth Sirrush, a Russia-aligned intrusion set that overlaps with CERT-UA’s UAC-0099 designation. The lures impersonated police and tax authorities, delivering archives and HTA files that installed infostealers and remote access tools.
The original analysis publicized 52 network IoCs. Aided by the WhoisXML API MCP Server², we investigated 49 of them—one subdomain, six email addresses, 21 domains, and 21 IP addresses—after excluding three domains owned by legitimate entities.
Original IoCs Analyzed
Subdomain, email address, domains, and IP addresses from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Subdomain and email IoC examination
- Domain IoC WHOIS and DNS history analysis
- IP IoC geolocation and traffic analysis
- Email- and IP-connected domain discovery
- Malicious artifact confirmation
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/earth-sirrush-russia-aligned-intrusion-set-4-years-evolving-espionage-tooling
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.
APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation
WhoisXML API uncovered 300+ additional artifacts linked to Operation RapidRust. Download the threat research materials now.
DNS Analysis: AI-Powered RatHat Smishing Campaign
WhoisXML API uncovered 8,400+ additional artifacts linked to RatHat. Download the threat research materials now.