SocGholish IoCs and Artifacts: Tricking Users to Download Malware
SocGholish, an initial-access threat, was recently observed deploying ransomware, according to ReliaQuest researchers.1
WhoisXML API used the indicators of compromise (IoCs) published by ReliaQuest to understand the threat’s infrastructure and uncover more artifacts. Our research revealed:
- From six IoCs, an unredacted registrant email address was found
- 200+ artifacts registered by the same person behind an IoC
- 50+ additional artifacts related to the IoCs either through name server or string usage
- Malicious web properties, accounting for more than 5% of the artifacts
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.reliaquest.com/blog/socgholish-fakeupdates/
Latest Reports
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.
APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation
WhoisXML API uncovered 300+ additional artifacts linked to Operation RapidRust. Download the threat research materials now.