Profiling the Threat Actor Known as “Hagga” and His Work

The threat actor known as “Hagga,” first identified in the latter part of 2021,¹ has been using Agent Tesla to steal sensitive user information for some time now. Published reports have identified several indicators of compromise (IoCs)² believed to be part of Hagga’s criminal infrastructure.

Our researchers scoured the Web for more artifacts, allowing us to uncover:

• An additional IP address that could be part of Hagga’s malicious network
• Four Duck DNS-hosted malicious domains that could be connected to the threat
• Around 100 subdomains containing the string “cdec22” similar to the possibly connected subdomain artifacts uncovered
• More than 300 domains containing the strings “statusupdate” and “heavy-dutyindustry” akin to the domains identified as threat IoCs

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/
• [2] https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1