Access our latest research and insights on WHOIS, IP, and DNS data for cybersecurity, data science, and other business purposes through our webinars, podcasts, white papers, threat reports, and videos from the Academy.
Have questions?
We have seen attackers exploit vulnerabilities in PDF reader Adobe Acrobat in the past. But we rarely hear about threat actors setting their sights on its lesser-known competitor Foxit PDF Reader, that is, until May 2024.1
A total of nine indicators of compromise (IoCs)—eight domain names and one IP address—have been made public on LevelBlue Labs.2 Could there be other potentially connected artifacts?
DDoS booter services have made launching attacks easier for cybercriminals, adding to the daily threats that individuals and organizations face. However, users of these tools inevitably leave online tracks, particularly in the DNS.
Building on a list of 644 IoCs uncovered by WhoisXML API threat researcher Dancho Danchev, our research team found more than 2,000 potential artifacts comprising:
Phobos ransomware, distributed via the ransomware-as-a-service (RaaS) business model, reemerged in connection to an 8Base attack.1
A total of 63 indicators of compromise (IoCs) comprising 46 domains and 17 IP addresses have been made public on 5 March 2024. The WhoisXML API research team sought to find out more about the 8Base Phobos ransomware campaign aided by our comprehensive DNS intelligence.
WhoisXML API threat researcher Dancho Danchev recently uncovered a dubious web hosting service provider—Advanced Web Tech (AWT), along with pertinent information about its owner and 14 domains that he has dubbed as indicators of compromise (IoCs).
The WhoisXML API research team expanded Danchev’s investigation by looking more closely at the IoCs and his other findings and found other potentially connected artifacts, including:
Phishing-as-a-service (PhaaS) and similar offerings have made cybercrime accessible to anyone willing to risk incarceration in exchange for quick-and-easy money. And the creators of Typhoon 2FA, a phishing kit said to be able to bypass two-factor authentication (2FA) on Microsoft 365 and Google accounts are taking advantage of that fact.1
A total of 103 Typhoon 2FA indicators of compromise (IoCs) have been identified to date.2 We found more possibly connected artifacts using our comprehensive DNS intelligence sources, including:
Stately Taurus, an APT group active since 2012, was recently seen targeting ASEAN countries, particularly Japan, Myanmar, the Philippines, and Singapore.
Building on lists of 30 IoCs,1, 2 WhoisXML API researchers found more than 130 connected artifacts comprising:
As 15 April 2024, the deadline for filing taxes in the U.S., draws near, it is not surprising that scammers have come out of their hiding holes once again. One particular U.S. tax scammer, in fact, has been reportedly going after small businesses and self-employed individuals.1
Three domains have been identified as indicators of compromise (IoCs) for the threat. We expanded that list to identify other web properties that could be part of the threat actor’s attack infrastructure and uncovered:
Yet another information-stealing malware TimbreStealer has been discovered. Threat actors were seen distributing it to target victims in Mexico using finance-themed phishing lures.
Building on the list of 152 IoCs,1 WhoisXML API researchers found more than 19,000 potential artifacts comprising:
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.