Peering into Midnight Blizzard’s DNS Footprint
WhoisXML API found 160 artifacts that could be connected to Midnight Blizzard. Download the threat research materials now.
Continue reading Download reportMore Signs of the more_eggs Backdoor Found in the DNS
Using resumes as a social engineering lure isn’t new. But they’re more often than not employed in run-of-the-mill phishing campaigns.
This time around, threat actor TA4557 utilized a weaponized resume to drop a backdoor called “more_eggs,” which leads to a persistent attack that results in credential theft.
The WhoisXML API research team obtained a published list of 17 more_eggs indicators of compromise (IoCs) and expanded it to identify more connected artifacts.1 Our in-depth analysis found:
- 35 email-connected domains
- 11 additional IP addresses, three of which turned out to be malicious
- 700 IP-connected domains, 131 of which turned out to be malicious
- 22 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/