Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Next Level: Typo DGAs Used in Malicious Redirection Chains

Summary: Unit 42 uncovered a campaign using 6,057 newly registered domains, all sharing the same WHOIS registrant email and resolving to IP address 91.195.240[.]123, that redirected users through subdomains to dictionary DGA-like domains and adult Android app download pages. The researchers identified a new variant they call typo DGAs - dictionary DGA domains containing typographical errors, such as pictidentifyive[.]pro - and found 178 such domains averaging 67 epoch-timestamp subdomains each, while the same registrant email tied to 444,898 domains, 99.98% of which resolved to the same IP.

Why it matters: Of 92 file samples contacting that single IP address, 89 - 96% - were malicious executables, and the same registrant email maps to 444,898 domains, so a detection strategy built on domain names alone is working against an actor who can generate them by the hundreds of thousands.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related