New MITRE ATT&CK Groups for 2025: A DNS Deep Dive

The MITRE Corporation typically updates its ATT&CK page by listing the new groups it monitors for malicious activity twice a year—generally in April and October. The latest Updates - April 2025¹ advisory listed seven new groups with corresponding lists of indicators of compromise (IoCs).

WhoisXML API dove deep into the seven groups’ DNS footprints and uncovered connected artifacts that have not yet been publicized. We specifically found:

• Three alleged victim IP records obtained from the Internet Abuse Signal Collective (IASC)² tied to three Autonomous System (AS) numbers
• 638 email-connected domains, six are malicious
• 26 additional IP addresses, 16 are malicious
• 221 IP-connected domains
• 4,195 string-connected domains, 37 are malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://attack.mitre.org/resources/updates/
• [2] https://main.whoisxmlapi.com/internet-abuse-signal-collective