Tracking Down APT Group WIRTE’s DNS Movements
WhoisXML API found 3,500+ artifacts that could be connected to the latest WIRTE attack. Download the threat research materials now.
Continue reading Download reportPeering into Midnight Blizzard’s DNS Footprint
While Midnight Blizzard is believed to have been active since 2008, its tactics continue to evolve to this day. The threat actor was recently observed leveraging signed Remote Desktop Protocol (RDP) configuration files to gain access to victims’ devices.
The target? Thousands of people connected to various organizations in the public, academia, and defense sectors.1
The WhoisXML API research team expanded a list of 39 domains tagged as indicators of compromise (IoCs), 34 of which were extracted from subdomain IoCs. Our analysis led to the discovery of:
- 18 email-connected domains
- 16 IP addresses, 11 of which were malicious
- 20 IP-connected domains, one of which was malicious
- 106 string-connected domains, six of which were malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/