Profiling the Threat Actor Known as "Hagga" and His Work | WhoisXML API

Threat Reports

Profiling the Threat Actor Known as “Hagga” and His Work

The threat actor known as “Hagga,” first identified in the latter part of 2021,1 has been using Agent Tesla to steal sensitive user information for some time now. Published reports have identified several indicators of compromise (IoCs)2 believed to be part of Hagga’s criminal infrastructure.

Our researchers scoured the Web for more artifacts, allowing us to uncover:

  • An additional IP address that could be part of Hagga’s malicious network
  • Four Duck DNS-hosted malicious domains that could be connected to the threat
  • Around 100 subdomains containing the string “cdec22” similar to the possibly connected subdomain artifacts uncovered
  • More than 300 domains containing the strings “statusupdate” and “heavy-dutyindustry” akin to the domains identified as threat IoCs

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

  • [1]
  • [2]
Try our WhoisXML API for free
Get started