Hunting for TimbreStealer Malware Artifacts in the DNS
WhoisXML API found thousands of artifacts potentially connected to the newly detected TimbreStealer malware. Download the threat research materials now.
Continue reading Download reportFrom Counties to Banks: Tracing the Footprint of Ransomware Attack IoCs
On 11 September 2022, a U.S. country announced that it fell prey to a cyber attack. SecurityScorecard believes the Cryxos trojan may be involved and published an in-depth analysis,1 which included three IP addresses tagged as indicators of compromise (IoCs).
WhoisXML API researchers built on the report in a two-part investigation where we looked into the IoCs involved in the U.S. county attack and those connected to the Cryxos trojan. Our key findings include:
- One of the IP addresses tagged as an IoC had one resolving domain whose WHOIS history led us to 4,400+ potential artifacts.
- We found 390+ domains connected to the Cryxos IoCs, some of which were malicious and targeted banks.
- We uncovered 1,400+ Chase Bank typosquatting properties, nearly half of which were malicious.
Get access to our findings and uncover more on your own. Download the report now.
—
- [1] https://securityscorecard.com/research/cyber-risk-intelligence-county-government-cyber-incident-may-have-involved-social-engineering-and-targeting-of-vulnerable-ssh-services