Unlocking the DNS Strongbox of BADBOX 2.0 | WhoisXML API
WhoisXML API found 3,250+ artifacts that could be connected to BADBOX 2.0. Download the threat research materials now.
Continue reading Download reportExploring the DNS Flipside of SideWinder
The SideWinder advanced persistent threat (APT) group, active since 2012 and known for targeting government, military, and business entities throughout Asia, primarily Pakistan, China, Nepal, and Afghanistan,1 changed gears. They not only updated their toolset and created new infrastructure but also significantly increased attacks against maritime and logistics companies notably in Djibouti and Egypt and nuclear power plants in South Asia and Africa.
Researchers identified 35 domains as indicators of compromise (IoCs),2 which we expanded to find more connected artifacts. We uncovered:
- 35 email-connected domains
- Two IP addresses, one of which turned out to be malicious
- 10 IP-connected domains
- 532 string-connected domains, 16 of which have already figured in cyber attacks
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://attack.mitre.org/groups/G0121/
- [2] https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/