Threat reports

Potential Traces of Aurora Spread Via Windows Security Update Malvertisements in the DNS

Aurora first made news headlines in December 2022 when it was used as the final payload for fake software installer campaigns.¹ It recently resurfaced, now being spread via malvertisements that redirected users to a supposed Windows security update page. Should their download finish, they end up with Aurora-infected computers.²

Malwarebytes Labs identified 23 indicators of compromise (IoCs), which we subjected to an expansion analysis that found:

Uncovering Stolen Card E-Shops Using DNS Intelligence

Credit card numbers and other personally identifiable information (PII) unknowingly given to phishers can end up for sale on the ever-growing number of stolen card e-shops today.

Security researcher Dancho Danchev collated 20 email addresses belonging to known carders via OSINT research. Using these addresses as jump-off points, TIP researchers uncovered:

Gauging the Scale of an Active Ransomware Gang's Infrastructure

Many already know that ransomware operators can earn hundreds of millions each year.¹ But what they may be unaware of is that 75% of a gang’s earnings go to their affiliates.²

Dancho Danchev identified three email addresses that belonged to ransomware affiliates, along with 21 domains that figured in their campaigns. Using these indicators of compromise (IoCs) as jump-off points, TIP researchers were able to identify other artifacts, namely:

Profiling a Massive Portfolio of Domains Involved in Ransomware Campaigns

Ransomware is a real and immense threat that can cost organizations millions or, worse, their reputation after a potential data exposure.

To help the cybersecurity community and law enforcement agencies with threat attribution, detection, and disruption, TIP researchers analyzed a sample taken from 62,000+ domains known to be involved in ransomware campaigns. Our key findings include:

From Data Breach to Phishing to Lapsus$: Cyber Attacks That Echoed in 2022

Every year, the cybersecurity landscape evolves and unbelievably expands with new and more sophisticated attack tactics.

Despite that, malicious actors may leave imprints that enrich threat intelligence sources. To demonstrate, TIP researchers dove into three of the most significant cybersecurity incidents of 2022. Our key findings include:

Black Friday and Cyber Monday Bring on the Scariest Sales

Black Friday and Cyber Monday typically reel in the biggest profits for shops across North America. It’s only natural then for cybercriminals the world over to take advantage of the events.¹

A Call for Help May Lead to Malware: BazarCall IoC Analysis and Expansion

Recently seen callback phishing tactics highlight threat actors’ manipulative skills. They bait potential victims using urgent emails then employ legitimate-looking domains and web pages when victims call back for help. 

Should Cracks and Keygens Remain a Cybersecurity Concern?

Many users, particularly those that don’t want to spend tons of money on software licenses, still troop to crack and keygen sites. While not all of them are malicious, many of their offerings could put individuals and companies at great risk.¹  

XCSSET Shows How Threat Actors Cope with OS Changes, Does Away with Python Like macOS

XCSSET first appeared in 2020.¹ But it fell off cybersecurity researchers’ radar last year after macOS Monterey discontinued its support for Python—the malware’s primary language. Since April this year, however, XCSSET minus Python has resurfaced.²

Matanbuchus with Cobalt Strike: Not Your Favorite Combo

A malware-as-a-service (MaaS) package called “Matanbuchus” was found dropping Cobalt Strike beacons, allowing threat actors to communicate with the compromised network.¹

Phishing Automated through Chatbots, We Found Potentially Connected Domains

There is a new phishing tactic that employs chatbots to automate credential theft and increase the legitimacy of phishing sites. Bleeping Computer¹ mentioned only one IoC, a cybersquatting subdomain targeting DHL.

Don’t Hit That Update Button Just Yet, It Could Lead to Malware Infection

Microsoft regularly pushes out updates, sometimes even upgrades, for its software in an effort to heighten their security and fix bugs. But it’s also usual, too, to see news about threat actors taking advantage of the huge Windows user base by rolling out updates that are actually malware in disguise.

A Look at Actinium/Gamaredon’s Infrastructure: More Artifacts Revealed

Nearly-a-decade-old advanced persistent threat (APT) group Actinium/Gamaredon seemed to have gained a new lease on life as they recently resurfaced to target several Ukrainian organizations.¹

When Safe Doesn’t Mean Threat-Free, Watch Out for Rogue Internet Safety Sites

Threat actors will capitalize on anything, even sites that hint at promoting digital safety, to spread mayhem. We looked at thousands of Internet safety-themed domains and subdomains in commemoration of Safer Internet Day¹ to identify how many of them may not be worth trusting.

Q2 2021 Paypal Phishing & Typosquatting Report

PayPal phishing attacks are highly prevalent and the company remains one of the most impersonated brands. As typosquatting domains are often associated with phishing and impersonation attacks, Threat Intelligence Platform (TIP) prepared the Q2 2021 PayPal Phishing Report. 

In this report, we uncovered PayPal-related domains and subdomains registered or added within the period.