Practical Examples Of Malware Infrastructure Discovery With Passive DNS
By Matthew @ Embee Research - 2024-07-19
Introduction Passive DNS is a powerful tool that enables analysts to discover infrastructure through patterns contained in DNS records.
Hunting Lazarus: Expanding Indicators with Historic DNS
Introduction Lazarus Group (APT38) is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau that has been active since 2009 and is widely thought to be responsible for the Sony Pictures Entertainment cyber-attack in 2014.
Poseidon Analysis - Quick and Intuitive Workflows with Validin
Introduction Validin has an extensive database of Passive DNS (PDNS) and Web data that allows an analyst to quickly and intuitively analyse domains and identify additional infrastructure.
Using Favicon Hashes to Expand Threat Knowledge
Validin tracks the favicon hashes of hundreds of millions of websites, enabling you to quickly identify similar websites based on the favorite icon they advertise.
Revealing Australian Toll Spammer Infrastructure With PDNS
Introduction We’ve all seen those annoying spam messages that prompt us to click on links related to outstanding payments.
Expanding APT42 Intelligence with Validin
Introduction In this blog post, we’ll use indicators from a recent threat report as a starting point for further enrichment in the Validin platform to find additional likely-related infrastructure.
Hunting for "Unpaid Toll" Phishing Campaigns with Validin
Introduction On April 12th, 2024, the FBI published a public service announcement warning of a smishing scam regarding “debt for road toll services.
Unearthing a phishing campaign against Calendly
Introduction In this post, we’ll use Validin’s comprehensive DNS and endpoint responses to uncover a threat actor that uses Calendly phishing domains to steal user credentials.
Unmasking Crypto Phishing Websites with Validin
Introduction In this post, I’ll walk you through the discovery process of using Validin’s extensive domain and IP crawling data to find dozens of related crypto-themed phishing websites.
Finding “Lost iPhone” Smishing with Validin
Introduction In this post, I’ll walk through another real-world example of smishing, this time from a LinkedIn post (also found on this blog) detailing a phone theft experience that nearly resulted in an additional account takeover via a likely targeted phishing campaign.
End of content
No more pages to load