Probing the DNS Depths of PHALT#BLYX

An analysis of stealthy campaign PHALT#BLYX that targeted the European hospitality sector revealed its use of click-fix social engineering, fake CAPTCHAs, and fake BSOD pages to trick users into downloading DCRat. All that so the threat actors could take full remote access to infected systems and drop secondary payloads. The researchers cited 11 original IoCs in their report.¹

We analyzed 12 IoCs in total—one URL, eight domains, and three IP addresses—after further scrutiny. Our investigation uncovered these findings:

• Three domains identified as IoCs were deemed likely to turn malicious 28–177 days before being reported as such
• 7,099 unique potential victim IP addresses communicated with two IP addresses identified as IoCs
• 21,638 email-connected domains, four of which turned out to be malicious
• Six additional IP addresses, five of which turned out to be malicious
• Six IP-connected domains, three of which turned out to be malicious
• Seven string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.securonix.com/blog/analyzing-phaltblyx-how-fake-bsods-and-trusted-build-tools-are-used-to-construct-a-malware-infection/