Going DNS Deep Diving into GhostCall and GhostHire

BlueNoroff struck again, this time with interrelated campaigns GhostCall and GhostHire.¹ The actors went after tech company execs, venture capitalists, and Web3 developers, stealing personal information and other well-kept secrets.

Securelist identified 39 domains as IoCs, which we further analyzed. Our investigation led to these findings:

• 1,345 unique client IP addresses communicated with one of domains identified as IoCs
• Six domains identified as IoCs were bulk-registered with two look-alike domains each
• 11 domains identified as IoCs were deemed likely to turn malicious 266–723 days before they were dubbed as such
• Four email-connected domains, three were found malicious
• 24 IP addresses, 21 were found malicious
• 16 IP-connected domains, six were found malicious
• 993 string-connected domains, 18 were found malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/