2018 Accountability Blog DNS 
Krebs on Security
FEBRUARY 18, 2019
27, 2018, Cisco’s Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed “ DNSpionage.” Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains (e.g. PASSIVE DNS.
Krebs on Security
FEBRUARY 4, 2019
Spammy Bear targeted dormant but otherwise legitimate domains that had one thing in common: They all at one time used GoDaddy’s hosted Domain Name System (DNS) service. The domains documented by MyOnlineSecurity all had their DNS records altered between Jan. 31 and Feb. 22 report on the GoDaddy weakness. Image: Farsight Security.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Krebs on Security
JANUARY 22, 2019
In July 2018, email users around the world began complaining of receiving spam which began with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid. 13, 2018 bomb threat hoax. ” SAY WHAT? domaincontrol.com, and ns18.domaincontrol.com.
Krebs on Security
MARCH 2, 2020
In 2018, security intelligence firm HYAS discovered a malware network communicating with systems inside of a French national power company. When it didn’t hear from French authorities after almost a week, HYAS asked the dynamic DNS provider to “ sinkhole ” the malware network’s control servers.
Security Affairs
AUGUST 7, 2019
group_b : from August 2017 to January 2018 3. group_c : from January 2018 to February 2018 4. Indeed during the group_a, the main observed delivery techniques where about Phishing (rif.T1193) and Valid Accounts (rif.T1078). group_a : from 2016 to August 2017 2. About the author: Marco Ramilli, Founder of Yoroi.
Fox IT
JANUARY 12, 2021
After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim. Information regarding these remotes services is taken from the mailbox, cloud drive, or other cloud resources accessible by the compromised account.
McAfee
FEBRUARY 4, 2021
This blog is part of our SOCwise series where we’ll be digging into all things related to SecOps from a practitioner’s point of view, helping us enable defenders to both build context and confidence in what they do. . And they didn’t even give it a DNS look up until almost a year later.
Expert insights. Personalized for you.
265 
Let's personalize your content