On the Frontlines of the Syrian Electronic Army’s Digital Arsenal
Possibly one of the first public Internet armies, the Syrian Electronic Army is notorious for stealing user credentials to deface websites. Among their suspected victims are U.S. government websites, media outlets, PayPal, and eBay. Two of its members were indicted in 2018.1
WhoisXML API researchers, with initial inputs from threat researcher Dancho Danchev, recently uncovered active cyber resources possibly tied to the threat group. The investigation revealed:
- Dozens of unredacted email addresses known to belong to the Syrian Electronic Army
- 440+ responding IP addresses known to be involved in the threat group’s campaigns
- 770+ connected domains, either registered using the group’s email addresses or resolving to the IP addresses related to the group
- About 77% of the domains have active IP resolutions
Get access to our findings and uncover more on your own. Download the report now.
—
- [1] https://www.justice.gov/usao-edva/pr/two-members-syrian-electronic-army-indicted-conspiracy
Latest Reports
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.
APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation
WhoisXML API uncovered 300+ additional artifacts linked to Operation RapidRust. Download the threat research materials now.