Unloading MintsLoader IoCs Using DNS Intelligence
WhoisXML API found 190 artifacts associated with a recent MintsLoader campaign. Download the threat research materials now.
Continue reading Download reportSneaking a Peek into the Inner DNS Workings of Sneaky 2FA
Phishing-as-a-service (PhaaS) offering Sneaky 2FA was recently used in an adversary-in-the-middle (AitM) attack targeting Microsoft 365 users. It reportedly used fake Microsoft authentication pages with automatically filled-in email address fields to add to its sense of authenticity to lure in victims.1
Researchers analyzed the threat and identified at least 61 indicators of compromise (IoCs) comprising 57 domains, two IP addresses, and two subdomains.
The WhoisXML API research team analyzed Sneaky 2FA’s DNS footprint through an IoC list expansion analysis and uncovered potentially connected artifacts, namely:
- 342 email-connected domains based on historical WHOIS records, 14 of which have already been weaponized for various campaigns
- 49 additional IP addresses, 36 of which turned out to be malicious
- 235 IP-connected domains, two of which have already been tagged as malicious
- 216 string-connected domains, one of which has already figured in a malicious campaign
- 50 string-connected subdomains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/