Corralling SCATTERED SPIDER with DNS History
By Kenneth Kinion - 2024-09-16
On September 10, 2024, Arda Büyükkaya from EclecticIQ published a thorough update on SCATTERED SPIDER (also called 0ktapus).
Practical Examples Of Malware Infrastructure Discovery With Passive DNS
Passive DNS is a powerful tool that enables analysts to discover infrastructure through patterns contained in DNS records.
Hunting Lazarus: Expanding Indicators with Historic DNS
Lazarus Group (APT38) is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau that has been active since 2009 and is widely thought to be responsible for the Sony Pictures Entertainment cyber-attack in 2014.
Poseidon Analysis - Quick and Intuitive Workflows with Validin
Validin has an extensive database of Passive DNS (PDNS) and Web data that allows an analyst to quickly and intuitively analyse domains and identify additional infrastructure.
Using Favicon Hashes to Expand Threat Knowledge
Validin tracks the favicon hashes of hundreds of millions of websites, enabling you to quickly identify similar websites based on the favorite icon they advertise.
Revealing Australian Toll Spammer Infrastructure With PDNS
We’ve all seen those annoying spam messages that prompt us to click on links related to outstanding payments.
Expanding APT42 Intelligence with Validin
In this blog post, we’ll use indicators from a recent threat report as a starting point for further enrichment in the Validin platform to find additional likely-related infrastructure.
Hunting for "Unpaid Toll" Phishing Campaigns with Validin
On April 12th, 2024, the FBI published a public service announcement warning of a smishing scam regarding “debt for road toll services.
Unearthing a phishing campaign against Calendly
In this post, we’ll use Validin’s comprehensive DNS and endpoint responses to uncover a threat actor that uses Calendly phishing domains to steal user credentials.
Unmasking Crypto Phishing Websites with Validin
In this post, I’ll walk you through the discovery process of using Validin’s extensive domain and IP crawling data to find dozens of related crypto-themed phishing websites.
Finding “Lost iPhone” Smishing with Validin
In this post, I’ll walk through another real-world example of smishing, this time from a LinkedIn post (also found on this blog) detailing a phone theft experience that nearly resulted in an additional account takeover via a likely targeted phishing campaign.
Unwrapping Package Tracking Phishing with Validin
In this post, I’ll walk you through using Validin’s DNS history and enrichment capabilities to investigate a common smishing scam: text messages declaring that your package cannot be delivered due to incomplete address information.
Introducing Validin's Passive DNS Threat Hunting Platform
At Validin, we seek to make it as easy as possible to search for accurate, timely, and complete passive DNS about public networks for threat hunting and attack surface management.
End of content
No more pages to load