Unmasking the FreeDrain Network + Our Top 7 Pivots for Threat Hunting

Welcome to Validin's first email newsletter and thank you for inviting us into your inbox, it means a lot to us. We want you to feel confident in what you can expect from our monthly newsletter, Valid Points. We aim to bring you our most recent content in one place in what amounts to about a five-minute read. We welcome any feedback or suggestions as we embark on this new journey.

- The Validin Team

FEATURED RESEARCH

FreeDrain Unmasked: Uncovering an Industrial-Scale Crypto Theft Network

Unveiled at PIVOTcon and covered by Forbes, The Hacker News, and Infosecurity Magazine, our joint research with SentinelLABS exposes the FreeDrain Network: a sprawling, industrial-scale cryptocurrency phishing operation that has quietly siphoned digital assets for years. What began as an investigation into a single phishing page quickly uncovered a vast, coordinated campaign weaponizing search engine optimization, free-tier web services, and layered redirection techniques to systematically target and drain cryptocurrency wallets at scale. Read our full report.

FEATURED RESOURCE

Threat Hunt with Validin's Top 7 Pivots

To celebrate our time at PIVOTcon we're sharing our top 7 pivots. Discover how to uncover hidden infrastructure and expand your threat-hunting capabilities with our top seven pivot techniques. Learn how to leverage Bulk DNS, HTML Meta Tags, Favicon Hashes, Class Hashes, Registration Details, Host Response Features, and Lookalike Domains to expose connections that often go unnoticed. Dive deeper with real-world case studies and see how these techniques are helping threat hunters stay ahead of the curve. Download it for free now.

PRODUCT UPDATES

New Improvements to Projects and Saved Searches

• Configurable colors for project annotations in search results
• Add notes to indicators in projects
• Add references to projects
• Bookmark advanced search queries and lookalike domain searches
• [Enterprise Only] Fine-tune the types of alerts you want to receive for changes to indicators in projects
• [Enterprise Only] Save live scans directly to projects

Finding Booking.com themed ClickFix domains using Validin

Our investigation uncovers a phishing campaign impersonating Booking.com to distribute AsyncRAT, using tools like title tag and favicon hash pivoting to expose a broader network of malicious domains. Learn more.

Not Reality: Exploring Meta-themed Phishing with Validin

​We explored a Meta-themed phishing campaign, uncovering over 700 related domains by analyzing WHOIS registration patterns and host response features, revealing a sophisticated network of fraudulent sites impersonating Meta's Reality Labs.​ Read the full story.

Hunting Pandas: Investigating Mustang Panda and RedDelta

​ Vasilis Orlof's investigation traces a malware campaign linked to Mustang Panda and RedDelta, utilizing pivots on host banners, JARM fingerprints, and ASN data to uncover overlapping infrastructure and potential ties to APT41. Read now.