Fake DPRK-Linked Job Board, DMCA Takedown Scam, and a SentinelOne Integration

Welcome back to Validin's monthly newsletter and thank you for inviting us into your inbox. This past month we covered a DPRK fake job platform targeting U.S. AI talent and explored a DMCA takedown scam campaign. Additionally, our friends at SentinelLABS released a powerful Validin integration for threat hunting. As always, we appreciate any feedback! - The Validin Team

RESEARCH

Breaking Down the Mechanics and Intent of a Fake DPRK Job Board

Validin previously reported on Contagious Interview with our partners at SentinelLABS, but this past week we uncovered a new variant designed to socially engineer and compromise those seeking jobs as software developers, artificial intelligence researchers, crypto currency professionals, and others.

Our research covers the mechanics and intent of a fake job board, examines how it fits within the Contagious Interview ecosystem, and highlights what job seekers should watch for as adversaries continue to elevate their tradecraft.

👉 Read the full report now

Special thanks to cybersecurity reporter Sean Lyngaas of CNN for covering our latest research.

RESEARCH

Fake DMCA Takedown Notice Scam Hunting

Recently, two high profile YouTube content creators reported receiving fake DMCA takedown notices with links to malicious downloads, including Scott Manley and John Hammond. Several other researchers dissected this scam, analyzing the malware and AI-generated lure pages and identifying a number of related malicious domain names.

In our blog, we take a deeper look at the public infrastructure tied directly to this campaign, and show how to use Validin to discover other likely-related domain names and IP addresses based on DNS, host response, and other features.

👉 Read the blog now

Special thanks to Tanner at Huntress for investigating the initial phishing domain with Validin and John Hammond for the shout out in his video.

NEW UPDATES

Improved Domain and IP Summaries, Refreshed Projects, YARA-X Updates

Highlights:

• New, high-fidelity, summaries for domains and IPs on the Search page
• Refreshed Projects UI for clearer investigations
• YARA workflow improvements: easier filtering, deletion, and intelligent ordering of latest results
• YARA exits beta on December 1st; billing officially begins on January 1st

👉 Read the full update now

SENTINELONE INTEGRATION

Enhance Campaign Discovery with Validin and Synapse

SentinelLABS recently shared a Synapse Rapid Power-Up for Validin. Developed in-house by SentinelLABS engineers, the sentinelone-validin power-up provides commands to query for and model DNS records, HTTP crawl data, TLS certificates, and WHOIS information, enabling analysts to quickly search, pivot through, and investigate network infrastructure for time-aware, cross-source analysis.

In their post, they explore two real-world case studies to demonstrate how an analyst can use the power-up to discover and expand their knowledge of threats.

👉 Read the full blog

👉 Access the repo

FEATURING VALIDIN

Suspected Chinese Virtual Espionage Network

Max Lesser, Senior Analyst at Foundation for Defense of Democracies, uncovered a suspected Chinese virtual espionage network spanning 100+ websites. His report identifies TTPs, maps how these sites are linked and shows multiple clues tying the network’s backend operations to China. The Memetic Warfare guest post includes a list of suspicious domains so organizations and researchers can investigate and protect themselves.

👉 Read on Substack

(We ❤️ when researchers feature the platform in their write ups!)

BY THE NUMBERS

November's Top Viewed Threat Actor Profiles on Validin and their change from last month. If you're logged into Validin, view the full profiles:

1. ClickFix (no change)
2. Fake Software Downloads ⬆️ +1
3. Lazarus Group ⬇️ -1
4. Lumma Stealer ⬆️ +1
5. Poseidon Group ⬇️ -1