Thumbing through the DNS Trail of the TAOTH Campaign

Trend Micro analyzed what they dubbed as the “TAOTH Campaign,” which primarily targeted users across Eastern Asia. The attackers used fake software update, cloud storage, and login pages to distribute malware and collect sensitive information.

We analyzed eight indicators of compromise (IoCs)—three domains and five IP addresses—from the list Trend Micro compiled. Our deep dive led to these discoveries:

• 68 unique client IP addresses communicated with one domain IoC
• One potential victim IP address communicated with one IP IoC
• One domain IoC was dubbed likely to turn malicious 281 days before being reported as such
• 303 email-connected domains, one was malicious
• Two IP-connected domains
• 13 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.trendmicro.com/en_us/research/25/h/taoth-campaign.html