Exploring the SideWinder APT Group’s DNS Footprint
WhoisXML API found 570+ artifacts that could be connected to the SideWinder APT group. Download the threat research materials now.
Continue reading Download reportOn the DNS Trail of the Foxit PDF Bug Exploitation Attackers
We have seen attackers exploit vulnerabilities in PDF reader Adobe Acrobat in the past. But we rarely hear about threat actors setting their sights on its lesser-known competitor Foxit PDF Reader, that is, until May 2024.1
A total of nine indicators of compromise (IoCs)—eight domain names and one IP address—have been made public on LevelBlue Labs.2 Could there be other potentially connected artifacts?
The WhoisXML API research team sought to find out by expanding the current IoC list and uncovered:
- 55 registrant-connected domains, two of which turned out to be malicious
- One email-connected domain
- Eight additional IP addresses, six of which turned out to be malicious
- 44 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response.
—
- [1] https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/