Exposing the Infrastructure Behind Transparent Tribe and BlueNoroff

Welcome back to Validin's email newsletter and thank you for inviting us into your inbox, it means a lot to us. This month we covered previously unreported infrastructure related to Transparent Tribe, our top viewed Threat Actor profiles, product updates, and our time at Sleuthcon. As always, we appreciate any feedback! - The Validin Team

FEATURED RESEARCH

Illuminating Transparent Tribe with Validin

Validin's Founder Kenneth Kinion demonstrates how to leverage Validin’s passive DNS history and host-response data to uncover unreported infrastructure tied to APT36 (“Transparent Tribe”), giving security teams an early warning of emerging phishing domains and malicious IPs. Read the full article now.

BY THE NUMBERS

May's Top Viewed Threat Actor Profiles

If you're logged into Validin, view the full profiles:

1. Transparent Tribe
2. Kimsuky
3. Lazarus
4. Lumma Stealer
5. Clickfix

FEATURED RESEARCH

Zooming through BlueNoroff Indicators with Validin

In our latest blog, we walk you through how to pivot off Huntress’s new threat analysis and map out BlueNoroff-linked infrastructure. Using Validin’s DNS history, host-connection, and registration pivots, we trace a “fake Zoom extension” campaign back to nearly 200 related domains and critical IPs. You’ll learn hands-on methods like wildcard and range filters, rapid host pivots, and registration-time searches that show exactly how Validin equips security teams to detect emerging threats and get alerts well before adversaries make their move. Read the full breakdown here.

PRODUCT UPDATES

Smarter Tables, Pivoting, and Expanded Visibility are Coming Soon

We're getting ready to launch new features designed to make your investigations faster and more effective:

• Pivot History: Never lose track of your investigation. See exactly how you got to an interesting lead with full pivot history.
• Inline Pivoting via Slide-out: Test pivots directly from the UI with a single API call before committing to a full search.
• Slide-out Document Viewer: Click into a row to browse all related documents without leaving your view.
• Custom Table Views and Roll-Ups: Select the columns you want and group records by fields like IP address or port.
• Expanded Certificate Collection – We now collect certificates on additional ports, including RDP (3389), giving you more visibility into infrastructure activity.

More improvements are on the way — stay tuned!

ELASTIC SECURITY LABS

A Wretch Client: From ClickFix deception to information stealer deployment

Elastic Security Labs recently published their deep dive into Wretch Client, a malware tool leveraged by threat actors for espionage. In their investigation, Elastic credits Validin’s infrastructure intelligence for helping map out the supporting ecosystem behind Wretch Client’s operations. Read the full analysis.

IN THE FIELD

Validin takes Sleuthcon

We headed to Sleuthcon to present our investigation into a campaign in which suspected North Korean threat actors showed significant interest in Validin’s threat intelligence data, particularly infrastructure publicly attributed to them and related disclosures about their operations. We detailed how we attributed this activity to a specific North Korean threat cluster known for cyberespionage and financial crimes with a focus on targeting individuals and organizations in the cryptocurrency industry.