Research Center

Deepfakes can cause real harm. In February 2024, for example, an employee of a multinational company was tricked into handing US$25 million to a scammer who pretended to be their company’s CFO.¹

In light of this and similar attacks, security researchers have tried to shed more light into deepfake scams and the risks they pose. One report, in particular, unveiled 416 scam IoCs.²

The WhoisXML API research team investigated just how widespread deepfake scam infrastructures could be in the DNS through an IoC list expansion analysis. Our study uncovered potentially connected artifacts comprising:

The threat actors behind the malware that must not be named, also known as “Voldemort,” reportedly sent around 20,000 phishing emails that impacted at least 70 organizations worldwide.¹ Believed to be part of an advanced persistent group (APT), they used Voldemort distributed via weaponized Google Sheets files to infect the systems of target nations.

Nineteen indicators of compromise (IoCs) comprising 10 subdomains and nine IP addresses have already been identified, but more artifacts could be lurking in the DNS.²

Ransomware attacks are among the biggest threats organizations face, potentially costing them millions of dollars. One of the most recent campaigns involves the BlackSuit ransomware, a rebranded version of Royal ransomware. BlackSuit actors stole and exposed 1 million individuals’ full names, Social Security numbers (SSNs), birthdays, and insurance claim details.¹

In response, the Cybersecurity and Infrastructure Security Agency (CISA) updated its BlackSuit ransomware advisory, which now includes 91 indicators of compromise (IoCs) comprising 14 domain names, five subdomains, and 72 IP addresses.²

NetSupport RAT,¹ the weaponized version of legitimate remote device administration tool NetSupport Manager, is no longer a newbie when it comes to cyber attacks. It was first used in November 2023 and then again in January 2024.

Security researchers have performed in-depth analyses on the tool, in the process identifying nine domain names as indicators of compromise (IoCs).²

Threat actors will always find a way to get into their targets’ networks, even if they have to go through indirect channels. Such was the story behind the Polyfill supply chain attack.

Users of the content delivery network (CDN) service worldwide ended up with compromised networks courtesy of a malicious JavaScript code the cyber attackers injected.

The Extension Trojan, which first surfaced in 2021, has made a troubling resurgence in a recent campaign, impacting over 300,000 users globally.¹

Researchers have identified 22 indicators of compromise (IoCs) related to the attack earlier this August. But more artifacts could remain in the DNS.

Taking time out to duplicate mobile apps to create “evil twins” instead of just poisoning the versions available for download on marketplaces is a relatively novel infection tactic—one the threat actors behind Konfety used.¹ At least 250 mobile apps on Google Play alone have been affected so far and that could lead to ad fraud, unwanted browser extension installation, illicit web search monitoring, and sideloading malicious code onto devices.

The 2024 U.S. presidential elections is already a hotbed for tension, but more threats could be looming in the DNS in the form of cybersquatting domains. Often registered for profit, these domains could be exploited for far more sinister purposes.

Our research uncovered a staggering number of cyber resources linked to presidential candidates and election-related keywords. Our in-depth analysis revealed: