Newsletters

Who doesn’t love a good “The Sound of Music” reference! But did you know that there is a completely different movie based on the same subject matter that was filmed in Germany in 1956, a whole nine years before The Sound of Music? It’s called “Die Trapp-Familie” (or “The Trapp Family”). Unlike the American version, where the von Trapps escape to Switzerland at the end (cue Julie Andrews singing “Climb every Mountain”) - in the German version they emigrate to America, which is also what the “real” von Trapps did. And then there is also a movie sequel that captures their time living in the United States. And before you question my Super Fan status, yes I’ve visited most of the sites in and around Salzburg where “The Sound of Music” was filmed. I highly recommend it!

For those of you who came here for the weather report: April in Seattle was cold and wet. May is off to a bang with an 80 degree day already. This is totally fine. 

SPeaking of April, it’s been a high-velocity month for the team. Two weeks ago I was in Munich Germany for the FIRST CTI Conference, while the rest of the team spent most of their  time untangling the increasingly complex webs of state-sponsored modularity, from the DPRK’s institutionalized "burn-and-replace" tactics to the shifting veneers of Iranian influence operations.

In this edition, we’re breaking down how these actors are moving away from one-off attacks toward sustainable, parallel pipelines of espionage and disruption. We also take a look at some "clean" Chrome extensions that aren't nearly as helpful as they claim to be.

Let's dive into the research and get you caught up!
‍

Hot off the Presses

DPRK Malware Modularity: Diversity and Functional Specialization

DTI analysts broke down the modular design of the DPRK’s malware ecosystem. Analysis of multiple vendor, government, academic, and secondary reporting confirmed the DPRK operates a mature portfolio model of parallel malware development and rotation pipelines aligned to discrete strategic objectives. This structure enables the DPRK to conduct simultaneous espionage, revenue generation, and disruptive operations without cross-contaminating tooling, infrastructure, or exposure. 

What distinguishes the DPRK cyber program is not the existence of malware rotation itself, but how completely burn-and-replace logic is integrated into program design.Across the DPRK’s malware ecosystem, different DPRK threat actors are identified with specific malware tracks: espionage (Kimsuky), financial operations (Lazarus Group), and disruptions and coercion (Andariel). While the burn-and-replace model operated by the DPRK is not unique among nation-state threat actors, the degree of institutionalization and mission coupling seen in DPRK operations is unusually pronounced compared to their counterparts in Russia, Iran, and the PRC. 

‍

Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment 

DTI spent a lot of April analyzing cyber threats resulting from the conflict in Iran. Our researchers took a deep dive into the threat actor personas aligned with Iran’s Ministry of Intelligence and Security (MOIS; وزارت اطلاعات جمهوری اسلامی ایران). Specifically, the activity attributed to Homeland Justice, Karma/KarmaBelow80, and Handala was assessed as a single, coordinated cyber influence ecosystem aligned with the MOIS. These personas function as interchangeable operational veneers applied to a consistent underlying capability. Their purpose is not to reflect organizational separation, but to enable segmentation of messaging, targeting, and attribution while preserving continuity of infrastructure and tradecraft.

Across all observed phases, the actors exhibit clear temporal continuity, shared infrastructure patterns, and a repeatable operational workflow. The persistence of these elements, despite rebranding, indicates centralized direction and capability management. 
‍

‍

MOIS Linked MOIST GRASSHOPPER/ Homeland Justice/ KarmaBelwo80/ Handala Hackers/ Campaigns and Evolution 

As part of our team’s research into the MOIS cyber influence ecosystem, we examined evidence spanning U.S. government reporting, private-sector threat intelligence research, passive DNS and infrastructure enrichment, and longitudinal review of archived web and Telegram content to build a comprehensive analysis of the campaigns and operational evolution of the Handala/Homeland Justice/ Karma personas. Across these personas, the actors consistently employ a repeatable pattern of intrusion, data exfiltration, disruptive or destructive action, and rapid public disclosure through controlled infrastructure. This is reinforced by shared or cross-referenced domains, persistent use of Telegram for amplification and coordination, and common hosting and obfuscation strategies. The personas also exhibit consistent rhetorical framing, target selection logic, and methods of psychological coercion. 

The campaign demonstrates a progression from discrete, high-impact destructive events into a modular and adaptive operational toolkit capable of supporting a wide range of objectives across multiple target sets. Early activity, particularly during the Albania operations, was centered on singular, coordinated events in which long-term access culminated in ransomware-style encryption, wiping, and public attribution. Over time, however, these capabilities were not abandoned; instead, they were retained and integrated into a broader operational framework that supports espionage, surveillance, disruption, influence operations, and destructive capabilities in parallel, culminating in the attack on Stryker in March 2026. 
‍

‍

SecuritySnack - The AI Frame Campaign Continues

DTI analysts identified a Chrome extension impersonating Google's Authenticator application as part of an ongoing malicious campaign active since at least early 2026. The extension appears to use Chrome's localization system and skeleton code to bypass security reviews. Despite its functional appearance, it requests broad, unnecessary permissions and contains "dormant infrastructure”. This suggests a staged deployment model using a deploy clean, update dirty strategy, where the extension remains trustworthy on the surface while maintaining the architectural groundwork to deliver a malicious update without requiring further permission approvals from the user or the store.

This extension is linked to at least six others through a shared developer front, two of which already carry fully operational malicious payloads. These extensions utilize hidden iframes to inject attacker-controlled content into every webpage, deploy fraudulent paywalls for free services, and maintain bidirectional communication with C2 servers. The infrastructure maps directly to the AiFrame campaign, which reportedly compromised over 260,000 users from 2025 to present.
‍

‍

📚What We’re Reading 

In case you’re behind on your cybersecurity reading homework, DTI team member Ian Campbell’s monthly recommended reading list will get you up to speed! 

• The top article for the month: watchtowr Labs - The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) 
• The top research for the month: Europol - Internet Organised Crime Threat Assessment (IOCTA) 2026
• The top podcast for the month: Lawfare - The Shadowy World of Ransomware with Professor Anja Shortland 

‍📚See the full reading list here
‍

Where We’ll Be 

- DNS OARC, Edinburgh, UK - 16-17 May

- SLEUTHCON, Arlington, VA - 05 June
‍

Final Thoughts

As always, thank you to my returning readers! If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. And of course I hope you will be coming back to read future editions!

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here.

If you missed last month's content, here are some quick links:

• Doppelgänger / RRN Disinformation Infrastructure Ecosystem 2026
• SecuritySnack - CloudFlare Anti-Security For Phishing
• Exposure of TLS Private Key for Myclaw 360 in Qihoo 360 “Security Claw” AI Platform
• SecuritySnack - OpenAI Anti-Ads Malware

‍

Thanks for reading & see you next month!

-Daniel

https://www.linkedin.com/in/schwalbe/

https://infosec.exchange/@danonsecurity

‍

A new year, a new cover image! We recently went through another rebranding exercise, which brought new collateral templates. Most noticeably, it changed our corporate website. Some of you noticed, and let us know exactly how you felt about it! The DomainTools Investigations site (https://dti.domaintools.com) also got a make-over, and I think the main website compliments our DTI site nicely!

Regular readers will notice that once again the newsletter is a week “late” - but once again, there were good reasons for it. So I’m considering releasing it on the first Tuesday of the Month, instead of the last one. If you feel strongly one way or the other, please let me know in the comments (or email me). The use of song titles with numbers that correspond to the current edition for the newsletter title is sticking around for now. My friend @Kali Fencl started that when she helped me launch this newsletter over a year ago, and while it’s getting more difficult, I’m committed. 

Another thing that’s probably staying are mentions of the local weather! Returning readers know I live in Seattle, and the weather here is always a topic of conversation! For example, many of you think the rain never stops in Seattle. Movies depict torrential downpours, but we Seattleites don’t mind: Keep believing that. But in reality, fellow PNW-er Scott Losse explains it best. Check him out and follow him, he’s funny!

Unlike the East Coast (sorry friends!), we just had a brief, miraculous week of mild weather and sunshine. But as it is customary, "The Gray" has returned like clockwork. It’s that part of winter here, where blue sky quickly begins to feel like a distant memory, and dampness is king. Don’t worry, only three to four months of that!

Speaking of winter, while most of the world was recovering from New Year's Eve and shovelling their driveways, my team here at DomainTools Investigations was busy dissecting a fresh mountain of data. If you thought the i-Soon leak from a while back was a one-off, think again. We’ve been heads-down on the KnownSec leak, a fascinating look at one of the supposed "white hat" companies that turned out to be part of the backbone of China’s cyberespionage ecosystem.

Beyond the geopolitical chess match, we’re also tracking some more "down-to-earth" (read: predatory) threats. Our analysts have been playing a high-stakes game of whack-a-mole with a series of dubious online gambling apps that are currently targeting users across the globe with some surprisingly sophisticated evasion tactics.

And for those of you who appreciate a shorter read with your morning coffee, we have a new SecuritySnack focused on "Phishing Interviews." This investigation highlights a particularly cold-hearted campaign that weaponizes the job hunt, exploiting the trust of applicants to harvest government credentials and to drop remote access tools.

We’ve got a lot to cover to kick off the year, so let’s dive right in, and get you all caught up!

‍

Hot off the Presses

THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyberespionage Ecosystem

In November of 2025, an allegedly massive leak of data from Chinese company “KnownSec” was posted to a github account. The leak has since been pulled off of Github and downloaded by very few, and of those few who gained access, only one uploaded 65 documents as a primer to the leak elsewhere for others to see. DTI was able to get the 65 document images and this initial investigation is derived from this slice of a much larger leak that is out there but not available.

While Knownsec advertises itself as a “white hat” pillar in China’s cybersecurity landscape, the leak revealed the company operates a vertically integrated espionage stack for reconnaissance, exploitation, collection, and persistence, designed for both domestic surveillance and foreign intelligence operations in support of China’s security state. 

Its internal documents, product manuals, and data repositories show a company engineered to support Chinese national security, intelligence, and military objectives. Tools like ZoomEye and the Critical Infrastructure Target Library give China a global reconnaissance system that catalogs millions of foreign IPs, domains, and organizations mapped by sector, geography, and strategic value. Massive datasets containing real names, ID numbers, mobile phones, emails, and credentials allow Knownsec and its government clients to correlate infrastructure with people, enabling rapid deanonymization, targeting, and social engineering. On top of this data foundation, Knownsec’s offensive products – GhostX, Un-Mail, and Passive Radar – purport to provide a full intrusion and surveillance pipeline.
‍

‍

Pay to Lose: Dubious Online Gambling Games 

DTI analysts identified multiple clusters of dubious Android applications created in the past few weeks that are engaged in predatory gambling and real money gaming apps. Notably, these are not registered apps. They are intentionally misleading users into thinking they are legitimate and reputable through multiple tactics like spoofing the Google Play Store, creating fake reviews, generating fake public win declarations, and creating entire brands with marketing campaigns and broad distribution tactics. These clusters also attempt to evade detection and analysis by having post install code and configuration retrievals from actor controlled sites, which serve a dual purpose of distributing region specific content to users post installation.

The investigation is segmented into three distinct infrastructure clusters. Each cluster appears to target a general set of countries including Nigeria, India, Pakistan, and the Philippines. They also appear to have non-region specific user base targeting, including English, Portuguese, and Bengali speaking users. Despite the wide range of targets, the clusters share a common theme of mobile-focused gaming or gamified gambling apps to attract users for financial gain
‍

‍

Security Snack: Phishing Interviews

My team uncovered a malicious actor that has created several domain masquerades of small companies posing as job boards, interview themes, and login pages since approximately August 2025. 

The investigation revealed two distinct objectives. The first is a credential harvesting scheme targeting ID.me accounts — the official identity provider for US government services like the IRS and SSA — which can then be exploited to facilitate financial fraud, including tax refund theft and fraudulent unemployment benefits. 

The second cluster focuses on malware delivery, tricking job seekers via fake Microsoft Teams meeting invites to download a malicious, unsigned variant of the remote access tool Connectwise. This gives the attacker access to the victim’s machine where they may conduct follow-on attacks.

‍

What We’re Reading 

In case you’re behind on your cybersecurity reading homework, DTI team member Ian Campbell’s monthly recommended reading list will get you up to speed! 

• The top podcast for the month: ChinaTalk - Richard Danzig on AI and Cyber
• The top article for the month: CERT Polska - Energy Sector Incident Report
• The top research for the month: GTIG - No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network

📚Checkout the full reading list here📚

‍

Where We’ll Be 

• AFCEA West 2026, San Diego, CA, 10-12 February
• BSides Seattle, Redmond, WA, 27-28 February
• NICAR 2026, Indianapolis, IN, 5-6 March
• BSides SF, San Francisco, CA, 21-22 March
  
  • ‍Come see me speak on Saturday
    ‍

Final Thoughts

As always, thank you to my returning readers! If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. And of course I hope you will be coming back to read future editions!

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here.

If you missed last month's content, here are some quick links:

• Chinese Malware Delivery Domains Part IV
• The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operation
• B2B2C Supply Chain Attack: Hotel’s Booking Accounts Compromised to Target Customers

Thanks for reading - see you next month!

-Daniel

‍

The title of this month’s newsletter is a deep cut taken from the height of my favorite music genre, the admittedly awkwardly titled “Alternative Music.” What can I say, the 1990s in Seattle were wild, man - you had to be there. 

Speaking of being there, last week was the Thanksgiving Holiday here in the United States. Normally my newsletter goes out on the last Tuesday of the month, but considering a lot of security professionals in the US got Thursday and likely Friday off, we decided to push publication by a week, so hopefully more of you can enjoy this edition instead of it getting buried under mashed potatoes and gravy!

The weather here in the Pacific NorthWest has firmly settled into “damp mode” (IYKYK), and the temperatures have started to creep below 40 degrees Fahrenheit (below 4 degrees Celsius for my international friends). I refuse to call it “The Big Dark” however - stop trying to make “The Big Dark” happen, Gretchen! Despite the cold, I’m happy to report that the intensity of DomainTools Investigations’ research output is only heating up. 

Our flagship research for November, “Inside the Great Firewall,” is a three-part series based on a recent dump of documents and technical details of China’s censorship infrastructure. This massive leak provided us with over 500 gigabytes of internal operational data. I had the pleasure of joining Dave Bittner on the Research Saturday podcast from N2K | CyberWire to discuss our team’s work. 

In addition to this deep dive, we also published a threat intelligence report based on leaked internal documents from APT35 (Charming Kitten). This report maps the Iranian state-sponsored actor's organization, tool kit, and campaign strategies. It details their campaigns against Lebanon, Kuwait, Türkiye, Saudi Arabia, Korea, and domestic Iranian targets, with a focus on their use of Microsoft Exchange attack chains. As a former Exchange Admin, I took personal note of that detail and was glad those days were behind me!

Last but not least, my team and I attended CYBERWARCON in Arlington, Virginia a couple of weeks ago. It was great to connect with the community, we had a small sponsorship booth and had many excellent conversations with fellow practitioners. I personally like the timing of this one-day conference, as it’s a nice bookend to its sister conference SLEUTHCON, which we attended earlier this year.

November was packed with research and tasty threat intelligence, so let's dive right in and get you up to speed!

Hot off the Presses

Inside the Great Firewall Part 1: The Dump

In September 2025, a historic breach of China’s censorship infrastructure leaked over 500 gigabytes of internal data detailing the infrastructure, design, and companies involved with the Great Firewall (GFW). DTI researchers analyzed more than 100,000 documents, internal source code, work logs, configuration files, emails, technical manuals, and operational runbooks. 

Part 1 covers the human machinery behind the GFW and the consequences of the leak. This data links specific engineers and administrators to their roles across state-run ISPs (China Telecom, China Unicom, China Mobile), academic research institutions, and Ministry of State Security (MSS)-linked vendors.

🔗Read the report here

Inside the Great Firewall Part 2: Technical Infrastructure

In Part 2, DTI analysts offer a forensic reconstruction of the Great Firewall’s technical infrastructure. From spreadsheets detailing app endpoint behavior, user monitoring intervals, and hardware configurations to blueprint files illustrating node relationships and control flows, the data illustrates a highly centralized yet distributed architecture, built on cooperation between state-run ISPs, telecom vendors, university research labs, and policy-design entities. Using this data, our researchers mapped the operational logic, software structure, and institutional alignment driving the digital surveillance regime.

🔍Read the full technical deep dive here 

Inside the Great Firewall Part 3: Geopolitical and Societal Ramifications

In the final part of the series, our team analyzes the strategic doctrine behind the Great Firewall. This analysis reveals the GFW as a cornerstone of China’s broader governance model, extending internal social control mechanisms into the digital realm while also projecting power abroad. The regime serves a dual purpose of insulating the domestic population from undesired narratives and foreign influence, while exporting technologies, protocols, and ideological models of digital sovereignty to other authoritarian or aspiring technocratic regimes.

🔗Read our analysis here

Threat Intelligence Report: APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

In October, internal documents from APT35, also referred to as Charming Kitten, were leaked on Github. Our researchers reviewed and analyzed the leaked documents to form a tightly linked forensic trail that maps both technique and organization. In this report, we broke down APT35’s tool kit which covers reconnaissance, initial access, and post-exploitation tooling optimized for large-scale, quota-driven compromise operations. Our team analyzed the actor’s operational profile and campaign strategies, identifying an emphasis on weaponizing exchange attack chains (ProxyShell, Autodiscover, EWS enumeration, and PowerShell driven tasks) to extract mailbox contents and Global Address Lists, maintain mailbox-level persistence, HUMINT extraction, and iterative phishing loops based on harvested address books.

🔗Learn more here

What We’re Reading 

In case you’re behind on your cybersecurity reading homework, DTI team member Ian Campbell’s monthly recommended reading list will get you up to speed! 

• The top article for the month: GreyNoise Intelligence – When Bulletproof Hosting Proves Bulletproof: The Stark Industries Shell Game 
• The top research for the month: arXiv – Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models

📚Checkout the full reading list here📚

Where We’ll Be 

• SANS Cyber Threat Summit 2025, London, UK, 3-4 December

Final Thoughts

As always, thank you to my returning readers! If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. And of course I hope you will be coming back to read future editions!

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here.

If you missed last month's content, here are some quick links:

• DomainTools Investigations BSides NoVa Recap
• Repo the Repo - NPM Phishing
• Inside a Crypto Scam Nexus
• 18+ E-Crime

Thanks for reading - see you next month!

-Daniel

https://www.linkedin.com/in/schwalbe

https://infosec.exchange/@danonsecurity

https://www.linkedin.com/in/schwalbe

https://infosec.exchange/@danonsecurity

For the title of this tenth edition of my newsletter, I decided to go with a hit by “The Boss” (Bruce Springsteen for those of you who aren’t familiar). The obvious choice could have been 10 by Pear Jam, who hail from my adopted home town. But 10 is an album title, and not a song title, and we have patterns to follow! Speaking of Seattle, the days have gotten really short already, temperatures are dropping overnight, and I’ve resigned myself to packing away my summer clothes for another 9 months. On the other hand, the crisp air and the promise of Halloween candy, together with the return of some truly excellent TV shows make the indoor time a little more palatable.

But most importantly, spending more time indoors means more time to dive into research! My team has been absolutely prolific this month, bringing you some must-read research and showing up to engage with the community.

We’ve published a comprehensive analysis of the NPM Phishing attacks, where we analyzed how attackers stole developer credentials and bypassed MFA to compromise high-profile software repositories. We also took you Inside a Crypto Scam Nexus, exposing a web of wallet-drain scams tied to a single threat actor’s infrastructure. Furthermore, we’ve tracked a financially motivated cluster of more than 80 spoofed domains and lure websites in our 18+ E-Crime analysis, which were used to deliver Android and Windows trojans to users of age 18+ social media, online gambling, and government tax sites. Our team also attended and presented at BSides NoVa, where Ian Campbell presented on how Domain and DNS intelligence is a critical tool for investigative journalists and Malachi Walker spoke on the attack surface of Formula 1.

Let’s dive right in and get you up to speed!

Hot off the Presses

DomainTools Investigations BSides NoVa Recap

Our commitment to a thriving cybersecurity ecosystem means we put our time and resources toward contributing to collective knowledge and the common good. That’s why we were proud sponsors of BSides NoVa on October 10th and 11th.

Our team delivered two accepted talks, including Senior Security Ops Engineer Ian Campbell’s presentation on DNS and domain intelligence in investigative journalism, and colleague Malachi Walker’s talk on cyber threats in F1 racing. In his full write-up, Ian reflects on the importance of contributing to the infosec community and answers the question: Where do I learn how to do this kind of work?

‍

Read Ian’s recap here

‍

Repo the Repo – NPM Phishing

DTI researchers analyzed the series of high profile supply chain compromises caused by malicious code written to NPM repositories managed by stolen developer credentials. While developers of prominent NPM repositories have been targeted for many years,these events prompted CISA to release an alert due to their widespread nature.

Attackers used multi-stage fake NPM login pages to steal passwords and successfully intercept the legitimate email OTP/MFA code in real-time. This allowed attackers to establish their own authenticated sessions on the real npmjs[.]com while victims remained unaware their credentials had been stolen and their accounts compromised.

‍

Read our analysis here

‍

Inside a Crypto Scam Nexus

Our team of analysts uncovered a web of wallet-drain scams, ranging from browser extension popups and iPhone configuration profile traps to fraudulent web trading apps, were all tied to one threat actor’s infrastructure. We exposed how multiple websites such as medaigenesis[.]cc, novacrypt[.]net, and zzztd[.]com were hosted on the same server IP address, 8.221.100[.]222. These sites formed a coordinated infrastructure used to steal cryptocurrency from unsuspecting users.

This cluster of scams demonstrates how threat actors combine technical methods with deception to steal cryptocurrency. By controlling multiple domains and even a browser extension, they exploit trust at several levels: browser add-ons, app installation processes, and convincing web design. The single infrastructure behind these schemes also highlights how a determined attacker can leverage one setup to run multiple scams, from cryptocurrency theft to fake e-commerce.

‍

Read the full investigation here

‍

18+ E-Crime

Starting in September 2024, a financially motivated cluster of more than 80 spoofed domain names and lure websites began targeting users with fake applications and websites themed as government tax sites, consumer banking, age 18+ social media content, and Windows assistant applications. The actor used these spoofed domains to deliver Android and Windows trojans likely for the purpose of stealing credentials or more overtly through the use of fake login pages.

Learn more here

‍

What We’re Reading

In case you’re behind on your cybersecurity reading homework, DTI team member Ian Campbell’s monthly recommended reading list is sure to get you up to speed!

• The top article for the month: Bloomberg – Hackers Had Been Lurking in Cyber Firm F5 Systems Since 2023
• The top podcast for the month: Three Buddy Problem – JAGS LABScon 2025 keynote: Steps to an ecology of cyber
• The top research for the month: Dartmouth ISTS – From Chaos To Capability: Building the US Market for Offensive Cyber
  ‍

Checkout the full reading list here

‍

Where We’ll Be

• AFCEA Vegas Tech & Cyber Expo, Las Vegas, NV, 4-5 November
• CYBERWARCON, Washington, DC, 19 November

Final Thoughts

As always, thank you to my returning readers! If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. And of course I hope you will keep coming back to read future editions!

We share this newsletter via email as well – if you’d prefer to get it to your inbox, sign up here.

If you missed last month’s content, here are some quick links:

• Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat
• Inside the Kimsuky Leak: How the “Kim” Dump Exposed North Korea’s Credential Theft Playbook
• Newly Identified Domains Likely Linked to Continued Activity from PoisonSeed E-Crime Actor
• Banker Trojan Targeting Indonesian and Vietnamese Android Users

Thanks for reading – see you next month!

-Daniel

https://www.linkedin.com/in/schwalbe

https://infosec.exchange/@danonsecurity

‍

September is coming to a close, and with it, the sun bids adieu to Seattle (my home base) for another six months or so. Anybody who has lived here for more than a couple of years can recognize the exact day it happens. It’s a different date every year, but it’s unmistakable! In just 24 hours, it goes from pleasantly sunny, low 70s weather (low 20s C for my international friends) to min-50s (mid-teens in C) and rain. Summer is over, and the grey gloom returns to give birth to the Pumpkin Spice Latte. That day was yesterday 😕

But it’s not all bad. With less available daylight, we give ourselves permission to spend more time inside, and that means more time for research! If you are a returning reader, welcome back! If you are a new reader, what you are about to read is news from our group of researchers and analysts, where they provide their expertise in investigating, mitigating, and preventing Domain and DNS based attacks.

My team has been on a tear this month, we've published new research on Salt Typhoon, an advanced Chinese APT, and we've analyzed the massive Kimsuky leak, giving us a rare look into a North Korean threat actor's playbook. We also identified new activity from the PoisonSeed e-crime group, and uncovered a banking trojan targeting Android users in Southeast Asia. Let's get you up to speed!

Hot off the Presses

Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat 

Less than a week ago (25 September), we published research that maps Salt Typhoon’s infrastructure and operational profiles. The APT linked to the PRC’s Ministry of State Security has a targeting profile that spans the U.S., U.K., Taiwan, and the E.U., with confirmed breaches in at least a dozen U.S. telecom firms, multiple state National Guard networks, and allied communications providers. The research covers known intelligence and operational profiles, links to other entities within the PRC’s cyber espionage apparatus, and a deep dive into the infrastructure and behavioral patterns uncovered by our researchers. 

Salt Typhoon has demonstrated sophisticated spycraft in exploiting network edge devices, maintaining long-dwell persistence via firmware/rootkit implants, harvesting data from telecom providers, and using plausibly deniable contractor infrastructure to obscure attribution. Our research provides crucial intelligence for attribution, detection, and threat modeling of the observed activity.

🔗Read the full report here

Inside the Kimsuky Leak: How the “Kim” Dump Exposed North Korea’s Credential Theft Playbook

DTI researchers broke down the “Kim” leak, mapping the full scope of the North Korean threat actor’s infrastructure from custom Linux rootkits to particular targets like PKI infrastructure and specific tools like NASM and ocrmypdf. Our analysis also found a strategic pivot to include Taiwanese developer and government networks, revealing a clear geographical expansion of North Korea's cyber interests.

The leak provides a unique opportunity to look directly into a DPRK threat actor’s playbook. Moreover, it gives analysts and defenders insight into the actor’s operational profile, including credential-focused intrusions targeting South Korean and Taiwanese networks, with a blending of Chinese-language tooling, infrastructure, and possible logistical support.

🔗Read the full analysis here

—-----

Newly Identified Domains Likely Linked to Continued Activity from PoisonSeed E-Crime Actor

DTI researchers identified a set of malicious domains likely linked to the e-crime group known as PoisonSeed. The identified domains spoofed the email sender platform SendGrid and used fake Cloudflare CAPTCHA pages to steal enterprise credentials, with similar tactics, techniques, and procedures (TTPs) as those historically tied to SCATTERED SPIDER. 

While there is no definitive evidence of a direct link between PoisonSeed and SCATTERED SPIDER, the infrastructure identified as belonging to PoisonSeed highlights ongoing efforts by e-crime actors to use TTPs similar to SCATTERED SPIDER. These actors are likely continuing to leverage these TTPs to compromise enterprise credentials to facilitate a range of malicious activity.

🔗Learn more here

Banker Trojan Targeting Indonesian and Vietnamese Android Users

DTI researchers observed a threat actor spoofing trusted platforms like the Google Play Store to target  Android users in Southeast Asia. The actor disguised their malware as legitimate payment and government identity applications to trick Indonesian and Vietnamese users into downloading malware linked to BankBot.Remo.1.origin, a previously closed source banking trojan that had its source code leaked on Russian-language forums in 2016.

🔗Learn more here

—-----

What We’re Reading

With the arrival of fall, and back to school season in full swing, it got me thinking: Wouldn’t it be great if there were a scholastic book fair for cybersecurity? Well there isn’t, but there is my colleague Ian Campbell's monthly recommended reading list for September:

• The top article for the month: The Record - Ransomware gang takedowns causing explosion of new, smaller groups
• The top podcast for the month: Microsoft Threat Intelligence - Stopping Domain Impersonation with AI
• The top research for the month: arXiv - Large Language Models for Security Operations Centers: A Comprehensive Survey

📚Check out the full reading list here 📚

Where We’ll Be

• BSidesNOVA, Arlington, VA, 10-11 October
• GovWare, Singapore, 21-23 October
• TechNet Indo-Pacific, Honolulu, HI, 28-30 October

Final Thoughts

As always, thank you to my returning readers! If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. And of course I hope you will keep coming back to read future editions!

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here.

If you missed last month's content, here are some quick links:

• From Laptops to Laundromats: How DPRK IT Workers Infiltrated the Global Remote Economy
• Hunting for Malware Networks
• SpyNote Malware Part 2

Thanks for reading - see you next month!

-Daniel

https://www.linkedin.com/in/schwalbe

https://infosec.exchange/@danonsecurity

Can you believe August is almost over? Here in the Pacific Northwest, Summer is making its last stand. If the weather professionals are right, we will have another 10 days or so of temperatures in the low 80s (that’s high 20s in Celsius for my international readers), before Fall settles in. As every Seattleite knows, there is that one day in September, when the temperature drops suddenly, and the rain returns, and then it’s another 9 months before the best time of the year comes back. Not that we’re bitter or anything, those 3 months of summer are glorious and make all the rain worth it.

You know where it rarely rains though? Las Vegas! And that’s where the DTI team spent 8 days at the beginning of August for Hacker Summer Camp. Some people will argue that 8 days in Vegas is about 6.5 days too long. And the heat also did not disappoint, every day peaked north 

of 105F, or 40+ in Celsius. But luckily, it’s a dry heat they say 🙄

Our brilliant Marketing team had a great solution to keep us out of the heat: We chartered several shuttle buses that drove back and forth between Black Hat and the hotel where the larger DomainTools contingent stayed. Great advertising and we got to ride in style!

My other van is the DNS express!

Even if you didn’t work for DomainTools, you could catch a free ride. All for the price of being a captive audience and having to watch our demo reel 😎:

Come take a ride in my windowless black van!

The team had a packed schedule, and lots of community events to support! The Diana Initiative, BSides Las Vegas, Sober in Cyber, Black Hat, DEF CON, as well as a handful of other community events and cons that I cannot name publicly - IYKYK.

At the end of the week, I had the pleasure to present at DEF CON 33 in the Recon Village. I talked about how to use passive DNS to enumerate subdomains and how to effectively identify deep wildcards:

At the end of the week, I had the pleasure to present at DEF CON 33 in the Recon Village. I talked about how to use passive DNS to enumerate subdomains and how to effectively identify deep wildcards:

Did I mention it was hot? Shorts and T-shirt to the rescue!

My colleagues Ian Campbell and Malachi Walker also presented at DEF CON, together in the Malware Village and Malachi gave a second talk in the BIC Village

While the days were long and hot, and the nights were short and fueled by energy drinks, we loved every minute of it. Hacker Summer Camp is where “our people” meet, and we wouldn't miss it for anything!

If you are a returning reader, welcome back! If you are a new reader, what you are about to read is news from our group of researchers and analysts, where they provide their expertise in investigating, mitigating, and preventing Domain and DNS based attacks.

So without further ado, here’s what our incredible team has been up to for the rest of August:

From Laptops to Laundromats: How DPRK IT Workers Infiltrated the Global Remote Economy

In this post we discuss how the Reconnaissance General Bureau (RGB) of the DPRK orchestrated an operation that used stolen or forged identities to secure tech jobs for their operatives for the purpose of gaining access to intellectual property, and to receive salaries in cryptocurrency.

The article covers key actors like Song Kum Hyok, an officer in the Andariel subgroup, to facilitators who run "laptop farms" to create the illusion that the workers are U.S.-based. The money laundering process is also detailed, showing how funds are routed through front companies and crypto brokers in various countries to convert the fraudulently obtained wages into usable capital for North Korea's strategic programs, including weapons development.

Crypto transfers and money laundering

🔗Learn more here

https://dti.domaintools.com/from-laptops-to-laundromats-how-dprk-it-workers-infiltrated-the-global-remote-economy/?utm_source=LinkedIn&utm_medium=Social&utm_campaign=DTI-Newsletter-August

Hunting for Malware Networks

For this investigation, we took a look at recently active malware-as-a-service (MaaS) operations. We analyzed their use of web-hosted PowerShell scripts as an effective initial-stage payload delivery mechanism. This technique serves to compartmentalize the attack chain, reducing the exposure of core command and control (C2) infrastructure and complicating forensic investigations.

One example detailed in this article centers around a script that connects to a commonly used C2 domain, and was observed distributing over 60 different malicious files in the past 2 months. It included multiple stealer malware families such as Amadey, Lumma, Luca, DeerStealer, and RedLine as well as other malware families like Rugmi, BlackBasta and DarkGate.

The investigation into the broader infrastructure revealed a significant concentration of malicious activity originating from a small number of IP addresses, all associated with the same ASN. It seems likely that this ASN is part of a bulletproof hosting operation.

Additionally, threat actors appear to increasingly be leveraging legitimate distributed services like Amazon CloudFront and GitHub to host and deliver malware. This makes proactive network-based blocking more difficult. 

Analysis of 200 binaries in VirusTotal over the past 3 months show that there appears to be an overrepresentative share of LummaC2 and Amadey.

🔗Go hunting

SpyNote Malware Part 2

The SpyNote malware campaign has resurfaced, and the threat actors are employing deceptive websites that mimic the Google Play Store to trick users into downloading an Android RAT (Remote Access Trojan).

SpyNote is designed for surveillance, data exfiltration, and remote control of a victim's device. Its capabilities include keylogging, stealing 2FA codes, capturing audio and video, and remotely wiping data. This new campaign incorporates minor changes in the actor's tactics, such as slight IP resolution changes and the addition of anti-analysis techniques in the APK dropper to protect the payload from detection.

The malicious websites use JavaScript to initiate the download of a dropper APK. This dropper conceals its functions using DEX Element Injection and decrypts a second-stage SpyNote payload. The payload then loads the command-and-control (C2) logic from a separate file, using obfuscation to hinder static analysis.

Malware execution flowchart

🔗Catch that RAT

Cybersecurity Reading List - Week of 2025-08-25

In this latest installment of his reading list, my colleague Ian Campbell highlights a recent influx of new research and publications in the cybersecurity field. As always, he covers several different types of media, something for everybody:

• Podcasts: "Adversary Universe from Crowdstrike" for a perspective on AI, "CyberWire Research Saturday" for a deep dive into the VexTrio cybercriminal group, and "Prompt||GTFO" for demonstrations on how practitioners are using AI.
• Articles: An interview with a Kaseya hacker, and a piece on data exfiltration via DNS.
• Research Papers and Reports: Greynoise Intelligence study on how attack spikes can precede new CVEs, a RecordedFuture report on cloud threat hunting, and a CAIDA paper on early-stage traffic discovery.
• Tools and Resources: Learn about CISA's new open-source malware analysis platform, Thorium
• Entertaining Reading: "The Berners Street Hoax"

🔗Read more here 

Customer Webinar: Exclusive Recap of the DTI Team DEF CON 33 Talks 

For those who couldn't make it to Las Vegas, we're bringing these talks directly to you.

Here's what we'll cover:

• Malware in DNS: A look at how attackers hide malicious code in DNS TXT records.
• Pre-Identifying DNS Wildcards: Learn new techniques for subdomain enumeration and attack surface management.
• DNS Scavenger Hunt: An interactive session where you can put your skills to the test.

Webinar Details:

• Date: Tuesday, September 30th
• Time: 10:00 AM PT / 1:00 PM ET
• Duration: 1.5 hours

Where We’ll Be

• Underground Economy, France, 1-4 September
• Back to Las Vegas for private event, September 8-12
  • If you find yourself in the area that week, let us know and we’d be happy to meet up over a refreshing beverage
• DC Closed Door Session, National Harbor, MD, 17 September
  • TLP:RED research, please note “DFS Newsletter” in the “Referred By” section: https://dti.domaintools.com/request-an-invite/
• Intelligence & National Security Summit, National Harbor, MD, 18-19 September
• LABScon, Scottsdale, AZ, 17-20 September

Final Thoughts

As always, thank you to my returning readers! If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. And of course I hope you will keep coming back to read future editions!

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here. 

If you missed last month's content, here are some quick links:

• Malware in DNS: A Covert Delivery Mechanism
• Chinese Malware Delivery Domains: Part III - The "SilverFox" Campaign
• Where Everybody Knows Your Name: Observing Malice-Complicit Nameservers
• Iran's Intelligence Group 13: A Profile of a Covert Cyber Strike Unit

Thanks for reading - see you next month!

Daniel 

https://www.linkedin.com/in/schwalbe

https://infosec.exchange/@danonsecurity

OK, maybe not Wichita. But just one week from now, many of us will gather on the surface of the sun (Vegas in August) for Hacker Summer Camp. 

Speaking of Hacker Summer Camp - Come see my talk at DEF CON 33 in the Recon Village, on Friday, August 8 at 2:10pm. I’ll be demonstrating some methods for efficiently assessing a domain’s DNS wildcard status, and proposing a new “standard of care” for routine testing and logging of the wildcard status of ALL (FQDN, RRtype) combinations.

If you are a returning reader, welcome back! If you are a new reader, what you are about to read is news from our group of researchers and analysts, where they provide their expertise in investigating, mitigating, and preventing Domain and DNS based attacks.

So without further ado, here’s what our incredible team has been up to in July:

Malware in DNS: A Covert Delivery Mechanism

Our researchers discovered instances where executable files are stored in fragments within DNS TXT records, allowing them to persist until removed or overwritten. A notable finding, first observered between  2021 and 2022, involved "Joke Screenmate malware." Delivered via this method, it simulates destructive actions and interferes with user control. Additionally, we also found malicious Powershell scripts, acting as stagers for Covenant C2 servers, encoded in TXT records. This highlights a sophisticated technique used by actors to store and potentially deploy malware, with related C2 domains observed as far back as 2017.

Powershell script that acts as a stager

🔗Read more here

Chinese Malware Delivery Domains: Part III - The "SilverFox" Campaign

We’re continuing to track "SilverFox," a persistent cyber actor primarily operating during Chinese working hours. Since June 2023, SilverFox has established over 2,800 domains for malware delivery, targeting Chinese-speaking individuals globally. The campaign focuses on delivering Windows-specific malware through fake application download sites and deceptive update prompts. It utilizes spoofed login pages for various apps, including marketing, business sales, and cryptocurrency platforms. Operational changes by the actor include anti-automation measures, reduced site trackers, increased server distribution, and discreet registration details. As of June 2025, a significant number of identified domains were actively distributing malware. The motivations are largely suspected to be financial, including credential and financial theft, and potentially access brokering.

🔗Find that fox 

Where Everybody Knows Your Name: Observing Malice-Complicit Nameservers

Monitoring nameservers associated with malicious activities offers valuable insights into cybercrime ecosystems. Our team highlights the Russian bulletproof hosting service DDoS-Guard as a key area of focus, due to its links to criminal activity, terrorism, and espionage. A month-long analysis (13 May - 11 June, 2025) of DDoS-Guard's nameserver activity revealed thousands of domain transfers, creations, and deletions. They can be categorized into gambling/betting, cryptocurrency-targeting, and other malicious activities.

Using aged domains and sophisticated obfuscation techniques, examples included Indonesian gambling, phishing campaigns targeting gift card holders, and extensive malicious activity against CounterStrike: GO players,. The most active threats were observed within the cryptocurrency sphere, with domains emulating legitimate wallets and exchanges. Monitoring such nameservers can help establish behavioral patterns of malicious actors, and is recommended for digital asset and cryptocurrency services in order to identify and block associated domains.

🔗Name that nameserver 

Iran's Intelligence Group 13: A Profile of a Covert Cyber Strike Unit

Iran's Intelligence Group 13 is a covert cyber strike unit embedded within the Shahid Kaveh Cyber Group, part of the Islamic Revolutionary Guard Corps (IRGC) cyber arsenal. This group is characterized by its aggressive operations, ideological motivations, and positioning at the intersection of cyber-espionage, industrial sabotage, and psychological warfare. Our report assesses that Intelligence Group 13 is likely to be used for retaliatory digital operations, especially following recent U.S. airstrikes. The research details the group's hierarchy within the IRGC, including leadership figures like Hamidreza Lashgarian and Reza Salarvand. We also cover tradecraft, which includes disrupting critical infrastructure, pre-positioning malware, and aggressive intelligence collection. A key strategy is the integration of psychological warfare through propaganda fronts like CyberAveng3rs. The group is supported by an extensive ecosystem of contractors and front companies, which frequently rebrand to evade sanctions. Future campaigns are expected to blend cyber-kinetic threats with narrative manipulation, targeting critical infrastructure, public perception, and institutional trust.

🔗Learn more here

Where We’ll Be

• Hacker Summer Camp, August 3-10
  • Come say hi to our team at The Diana Initiative, BSidesLV, Black Hat, or DEF CON! We will also have a free shuttle bus to/from the Cosmopolitan and Mandalay Bay: https://www.domaintools.com/events/black-hat-2025-shuttle/  
• Underground Economy, September 1-4
• DC Closed Door Session, September 17
  • TLP:RED research, please note “DFS Newsletter” in the “Referred By” section: https://dti.domaintools.com/request-an-invite/

Final Thoughts

Again, if you’re a returning reader from last month, I thank you. If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. 

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here. 

If you missed last month's content, here are some quick links:

• How Threat Actors Exploit Human Trust: A Breakdown of the 'Prove You Are Human' Malware Scheme
• Eggs in a Cloudy Basket: Skeleton Spider’s Trusted Cloud Malware Delivery
• Mapping Hidden Alliances in Russian-Affiliated Ransomware

Thanks for reading - see you next month!

Daniel 

https://www.linkedin.com/in/schwalbe/

https://infosec.exchange/@danonsecurity

Where has this year gone?! We are six months into formally launching DomainTools Investigations (DTI) and subsequently this newsletter! If you’re a returning reader, I’m glad you keep coming back! If you’re a new reader, what you’re about to read is news from our group of researchers and analysts providing their expertise in investigating, mitigating, and preventing Domain and DNS based attacks.

Today, I had the opportunity to listen to a session at FIRSTCon25 where Tom Millar of CISA,  Eireann Leverett of Killara Cyber, Wendy Nather of 1Password, and Declan Ingram of Trust Hound, discussed cyber resilience in the current threat context. One of the core focuses during this session was Community and how cyber resilience is born out of Community. 

The message of Community resonated with me because of our work here with DTI and how great this Community has been through the years. So take a look around, and if you’d like to collaborate with us to get further in our analyses, please let us know. 

So without further ado, here’s what our incredible team has been up to in June:

🐀 Trust Exploited: NetSupport RAT

In our latest research, our team identified malicious multi-stage downloader Powershell scripts hosted on multiple themed websites including Gitcodes and fake Docusign captcha verifications. These sites attempt to deceive users into copying and running an initial powershell script on their Windows Run command. Upon doing so, the powershell script downloads another downloader script and executes on the system, which in turn retrieves additional payloads and executes them eventually installing NetSupport RAT on the infected machines.

🔗 Read more here

🕸️ Skeleton Spider (FIN6): Trusted Cloud Malware Delivery

This research combines technical insights and practical analysis for both general audiences and cybersecurity professionals. We examined how FIN6 uses trusted cloud services, such as AWS, to host malicious infrastructure, evade detection, and ultimately deploy malware through socially engineered lures.

🔗 Explore here

🛰️ Mapping Hidden Alliances: Russian-Affiliated Ransomware Ecosystems

Jon DiMaggio at Analyst1, Scylla Intel, and our team dove into Russian-affiliated Ransomware Groups. This work follows previous research DomainTools undertook in tracking ransomware families and provides a visual representation of hidden connections between criminal factions, going beyond just mapping “families” to understand the intricate relationships between them. The core focus was on identifying overlaps in human operators, code fragments, infrastructure, and TTPs.

Jon and I presented this at SLEUTHCON - to see our presentation, 👍& 🔔to the SLEUTHCON YouTube page.

🔗 Dive into the mapping

Cybersecurity Schlolastic Book Fair

Ian Campbell’s June Recommended Reading digest: 

• Qualys – Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
• Proofpoint – The Bitter End: Unraveling Eight Years of Espionage Antics—Part One
• Mandiant – Hello, Operator? A Technical Analysis of Vishing Threats

📚Click for the full list

Where We’ll Be

• FIRSTCon25, June 23-27
  • Are you here this week? Come find our team as we sponsor this wonderful event!
• Hacker Summer Camp, August 3-10
  • Come say hi to our team at The Diana Initiative, BSidesLV, Black Hat, or DEF CON! We will also have

Final Thoughts

Again, if you’re a returning reader from last month, I thank you. If you’re new, I hope you found this newsletter informational, helpful, and worthy of sharing with your peers. 

We share this newsletter via email as well - if you’d prefer to get it to your inbox, sign up here. 

If you missed last month's content, here are some quick links:

• Inside a VenomRAT Malware Campaign
• Hidden Threats of Dual-Function Malware Found in Chrome Extensions
• Scams and Malicious Domains Emerging from Breaking News

Thanks for reading - see you next month!

Daniel 

https://www.linkedin.com/in/schwalbe

https://infosec.exchange/@danonsecurity