Research Center

We have seen many data stealers siphon off confidential data from victims’ devices over the years.¹ And their perpetrators usually employed simple tactics like social engineering and phishing to install the malware on target systems. The Meduza Stealer may be the first stealer we analyzed that exploited a vulnerability.

An in-depth investigation of the Meduza Stealer unveiled 16 indicators of compromise (IoCs) comprising 13 domain names and three IP addresses earlier this month.²

There’s a first time for everything, they say. And guess what? That’s also true for cyber attacks. Or at least for the latest UTA0137 cyber espionage campaign targeting Indian organizations. It used DISGOMOJI, a malware coded in Golang and came in the guise of emojis.¹ 

A total of 24 indicators of compromise (IoCs) related to the DISGOMOJI-enabled attack comprising 19 domain names and five IP addresses have been made public so far.²

Phishers will always go after products and services with the greatest number of users to get the biggest bang for their buck.

The 20 most phished brands of 2024¹ have been named, but nothing about the potentially connected threat artifacts have been revealed yet. The WhoisXML API sought to do just that.

Operation Celestial Force is advanced persistent threat (APT) group Cosmic Leopard’s latest campaign targeting organizations primarily based in India.¹ The threat actors used an Android and Windows malware combination to steal confidential data from targets.

A report of an in-depth investigation of Operation Celestial Force identified 19 domains as indicators of compromise (IoCs), which the WhoisXML API research team expanded to uncover other potentially connected artifacts.

The founders of the cryptocurrency mixing services company Samourai Wallet, Keonne Rodriguez and William Lonergan Hill, were sentenced in April 2024. They are currently serving time for executing more than US$2 billion in unlawful transactions and laundering more than US$100 million in criminal proceeds.¹

The Samourai Wallet website was taken down and its mobile offerings taken off Google Play Store. Despite these efforts, though, do remnants of the crypto mixing services remain in the DNS?

The WhoisXML API research team sought to find out by expanding a list of three domains identified as indicators of compromise (IoCs). Our investigation uncovered:

Phishing is already a top global threat. So it doesn’t help the cybersecurity community and law enforcement agencies that even cybercrime newbies can now launch attacks aided by phishing kits.

That is, unfortunately, the case with a malicious campaign aided by the V3B Phishing Kit that has been targeting European banking customers.¹

The WhoisXML API research team expanded a list of 28 domains tagged as IoCs for a V3B Phishing Kit-enabled attack and found:

The cryptocurrency market has grown over the years. In fact, the market capitalization peaked at US$3 trillion in November 2021, experiencing subsequent ups and downs before reaching US$2.58 trillion in March 2024.¹ And while this trend is good, it may also spell bad news—more threat actors are bound to initiate crypto-centered scams.

The WhoisXML API research team was recently alerted to fake cryptocurrency-selling campaigns. We analyzed 130 domains believed to belong to fake crypto sellers. Our IoC expansion analysis found more than 2,700 potentially connected artifacts comprising:

New advanced persistent threat (APT) group Unfading Sea Haze, possibly advocating Chinese interests in the South China Sea, recently reared its head in May 2024.¹ A total of 34 indicators of compromise (IoCs) related to the Unfading Sea Haze attack was made public.

The WhoisXML API research team sought to follow the APT group’s digital breadcrumbs in the DNS to identify more connected artifacts. Our IoC list expansion analysis uncovered: