Despite law enforcement arrests targeting the Silver Fox threat group in mid-June 2026, its malware delivery network remains active as a Malware-as-a-Service (MaaS) platform. Affiliates continue to deploy hundreds of new typosquatted domains and exploit major cloud services to distribute an obfuscated Gh0stRAT variant.
DomainTools Investigations exposes the Zedxion and Zedcex ecosystem—a layered financial architecture leveraging disposable UK shell companies, persistent digital tokens, and UAE-based trade fronts to facilitate IRGC-linked sanctions evasion and illicit Iranian funds transfers.
Moving beyond traditional state-centric APT structures, the pro-Iran coalition of jihadist-aligned collectives, nationalist actors, and opportunistic groups coordinates via Telegram to turn low-cost cyber operations into high-impact psychological warfare. While individual actors primarily rely on technically unsophisticated tradecraft like DDoS-for-hire tools, website defacements, and recycled breach data, their strategic strength lies in speed, visibility, and rapid mobilization alongside real-world kinetic events.
The underground market for farmed and stolen accounts is booming—driven by lax signup security and corporate pressure to show user growth. In this SecuritySnack, DTI investigates active account reselling marketplaces, examines SEC regulatory risks, and shares actionable steps for fraud teams to detect and block synthetic accounts.
Despite law enforcement arrests targeting the Silver Fox threat group in mid-June 2026, its malware delivery network remains active as a Malware-as-a-Service (MaaS) platform. Affiliates continue to deploy hundreds of new typosquatted domains and exploit major cloud services to distribute an obfuscated Gh0stRAT variant.
DomainTools Investigations exposes the Zedxion and Zedcex ecosystem—a layered financial architecture leveraging disposable UK shell companies, persistent digital tokens, and UAE-based trade fronts to facilitate IRGC-linked sanctions evasion and illicit Iranian funds transfers.
Moving beyond traditional state-centric APT structures, the pro-Iran coalition of jihadist-aligned collectives, nationalist actors, and opportunistic groups coordinates via Telegram to turn low-cost cyber operations into high-impact psychological warfare. While individual actors primarily rely on technically unsophisticated tradecraft like DDoS-for-hire tools, website defacements, and recycled breach data, their strategic strength lies in speed, visibility, and rapid mobilization alongside real-world kinetic events.
The underground market for farmed and stolen accounts is booming—driven by lax signup security and corporate pressure to show user growth. In this SecuritySnack, DTI investigates active account reselling marketplaces, examines SEC regulatory risks, and shares actionable steps for fraud teams to detect and block synthetic accounts.
.png)
When government backlogs trigger appointment scarcity, scammers step in.This investigation exposes the mechanics of "scarcity scams"—from replica portals to weaponized session-recording tools. Discover how cybercriminals exploit administrative bottlenecks globally to extract fake fees and harvest critical identity data.
