Inspecting Konfety’s Evil Twin Apps through the DNS Lens
WhoisXML API found 640+ artifacts that could be connected to the Konfety evil twin app campaign. Download the threat research materials now.
Continue reading Download reportNew Zloader Campaign: Where Do IoCs Lead Us?
A new Zloader campaign has been detected. It is believed to be the work of the MalSmoke cybercrime group. More than 2,000 unique victim IP addresses have downloaded the malware, which exploits a vulnerability in Microsoft’s digital signature verification method.
WhoisXML API analyzed the initial list of IoCs to uncover artifacts and possible domain and IP connections. Our analysis includes:
- Registrant details analysis uncovering domains that share the exact registrant information as one of the IoCs
- 900+ domains artifacts, likely to be DGA, sharing the same registrar and name server details with the IoCs
- More than 10 active IP resolutions to seven unique IP addresses
- 2,000+ connected domains resolving to the same IP addresses
Download the threat research materials containing the data related to the Zloader campaign now.