Peering into Midnight Blizzard’s DNS Footprint
WhoisXML API found 160 artifacts that could be connected to Midnight Blizzard. Download the threat research materials now.
Continue reading Download reportThawing IcedID Out through a DNS Analysis
The current threat landscape continuously proves that the theory of evolution also applies to malware. The latest proof? IcedID, which went from being a run-of-the-mill banking trojan to a ransomware dropper.
More than 50 IP addresses and domains were publicly listed1, 2, 3, 4 as IcedID indicators of compromise (IoCs). WhoisXML API researchers subjected them to a DNS intelligence analysis to uncover more connected artifacts, including:
- Five unredacted email addresses historically used to register some of the domains identified as IoCs
- 44 domains registered using some of the registrant email addresses
- 22 domains resolving to IP addresses tagged as IoCs
- 33 domains sharing the same IP resolutions as some of the domains classified as IoCs
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol-part-2
- [2] https://otx.alienvault.com/pulse/64cb26ac4990112e3f9e662f
- [3] https://otx.alienvault.com/pulse/64c5cf320a92c0bdc8ab9068
- [4] https://otx.alienvault.com/pulse/6401246d57e5b0d2ff1c6c58