DomainTools

Leaping Down a Rabbit Hole of Fraud and Misdirection

51 — Thu, 29 Apr 2021 00:00:00 +0000

Joe Slowik identifies a methodology for uncovering likely campaigns and defensive advice to prevent BEC.

An Undersea Royal Road: Exploring Malicious Documents and Associated Malware

51 — Thu, 22 Apr 2021 00:00:00 +0000

DomainTools researchers have identified a phishing campaign targeting underwater research and weapon development organizations in the Russian Federation.

COVID-19 Phishing With a Side of Cobalt Strike

51 — Thu, 01 Apr 2021 00:00:00 +0000

Senior Security Researcher, Joe Slowik, analyzes an intrusion with COVID-19 themed lures actively targeting Vietnamese entities from late 2020 through early 2021.

Examining Exchange Exploitation and its Lessons for Defenders

51 — Wed, 10 Mar 2021 00:00:00 +0000

Insight on the rapid expansion in Microsoft Exchange exploitation and potential recourse in order for defenders to reduce the likelihood of intrusion.

Centreon to Exim and Back: On the Trail of Sandworm

51 — Wed, 03 Mar 2021 00:00:00 +0000

Learn how to more accurately disposition and prosecute intrusions with the background knowledge to appropriately categorize and understand identified intrusions.

The Continuous Conundrum of Cloud Atlas

51 — Thu, 25 Feb 2021 00:00:00 +0000

DomainTools researchers have identified persistent activity linked to previous analysis of initial access activity associated with an entity referred to as Cloud Atlas.

Visibility, Monitoring, and Critical Infrastructure Security

51 — Thu, 11 Feb 2021 00:00:00 +0000

Joe Slowik provides an overview of the Oldsmar incident and delivers defensive countermeasures and attack surface reduction recommendations.

Change in Perspective on the Utility of SUNBURST-Related Network Indicators

51 — Fri, 22 Jan 2021 00:00:00 +0000

Learn how organizations can defend against SUNBURST-like attacks by shifting their approach from external analysis to internal enrichment.

The Devil’s in the Details: SUNBURST Attribution

51 — Thu, 14 Jan 2021 00:00:00 +0000

Senior Security Researcher Joe Slowik outlines the attribution process, working to identify the threat actors responsible for the recent Solorigate activity.

Holiday Bazar: Tracking a TrickBot-Related Ransomware Incident

51 — Wed, 06 Jan 2021 00:00:00 +0000

DomainTools researchers recently learned of a ransomware campaign targeting multiple entities. The incident highlighted several methods of network and malware analysis th