Early Discovery and Prediction of Meduza Stealer IoCs with First Watch
Meduza Stealer, a malware exfiltrating data, spreads via subscription. Our analysis uncovers more domains linked to its campaign exploiting Windows SmartScreen.
Continue readingPeering into Midnight Blizzard’s DNS Footprint
While Midnight Blizzard is believed to have been active since 2008, its tactics continue to evolve to this day. The threat actor was recently observed leveraging signed Remote Desktop Protocol (RDP) configuration files to gain access to victims’ devices.
The target? Thousands of people connected to various organizations in the public, academia, and defense sectors.1
The WhoisXML API research team expanded a list of 39 domains tagged as indicators of compromise (IoCs), 34 of which were extracted from subdomain IoCs. Our analysis led to the discovery of:
- 18 email-connected domains
- 16 IP addresses, 11 of which were malicious
- 20 IP-connected domains, one of which was malicious
- 106 string-connected domains, six of which were malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/