RomCom and TransferLoader IoCs in the Spotlight

Proofpoint’s “10 Things I Hate about Attribution: RomCom vs. TransferLoader”¹ detailed connections between RomCom and TransferLoader. WhoisXML API further analyzed the campaign infrastructures, specifically the domains used in the attacks, to spot even more similarities and uncover new artifacts in a two-part investigation.

The first part covers our search for typosquatting domain groups (with an IoC and look-alike domains) and unraveling similarities. We found:

• Four domain IoCs appeared in five typosquatting groups
• Each typosquatting group had 3–8 domains, including one IoC
• Typosquatting domain groups were spotted between 650 days before and one day after their current WHOIS record creation dates

The second part covered our search for more insights on the IoCs along with new artifacts. We discovered:

• 19 domain IoCs were deemed likely to turn malicious upon registration
• 3,051 email-connected domains, 28 were malicious
• 28 IP addresses, 27 were malicious
• 17 IP-connected domains
• 1,682 string-connected domains, 24 were malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader