Illuminating ShadyPanda DNS Infrastructure Facts

ShadyPanda launched a seven-year-long campaign that affected the browsers of 4.3 million Chrome and Edge users to date. The actor’s secret? Some malicious extensions were featured and verified by Google, resulting in instant trust and massive distribution.

Koi Security identified seven IoCs¹ comprising four domains and three subdomains. After extracting unique domains from the subdomains, we accumulated six domains and three subdomains for further analysis.

Our in-depth investigation led to these discoveries:

• 105 unique client IP addresses communicated with four domains identified as IoCs
• 735 email-connected domains, one turned out to be malicious
• Seven IP addresses, six turned out to be malicious
• 18 IP-connected domains
• 76 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

[1] https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign#heading-7