Hunting for TimbreStealer Malware Artifacts in the DNS
WhoisXML API found thousands of artifacts potentially connected to the newly detected TimbreStealer malware. Download the threat research materials now.
Continue reading Download reportProfiling the Threat Actor Known as “Hagga” and His Work
The threat actor known as “Hagga,” first identified in the latter part of 2021,1 has been using Agent Tesla to steal sensitive user information for some time now. Published reports have identified several indicators of compromise (IoCs)2 believed to be part of Hagga’s criminal infrastructure.
Our researchers scoured the Web for more artifacts, allowing us to uncover:
- An additional IP address that could be part of Hagga’s malicious network
- Four Duck DNS-hosted malicious domains that could be connected to the threat
- Around 100 subdomains containing the string “cdec22” similar to the possibly connected subdomain artifacts uncovered
- More than 300 domains containing the strings “statusupdate” and “heavy-dutyindustry” akin to the domains identified as threat IoCs
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/
- [2] https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1