Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Spotlight: The Imperiosus Curse --A Tool of the Dark Arts

Summary: Cisco Talos uncovered a malvertising redirection network, with redirection domains operating since February 1, 2001, that funnels traffic from hundreds of typosquat domains such as hulu.cm, wellsfargo.cm and micorsoft.com toward advertising endpoints with little regard for the final destination. Talos found the network feeding traffic into the Kyle & Stan malware operation, though it believes the two are separate groups in a business relationship rather than one operation.

What's compelling: The redirectors have stayed hidden for roughly fourteen years partly by hosting on shared infrastructure like Amazon EC2, where one IP address, 184.73.247.179, also hosted 1,225 domains registered to a single email address, so blocking individual typosquats leaves the traffic provider itself intact.

Read the original at Cisco Talos ↗

Topics
Malware
Related