Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks

Summary: Unit 42 describes training a graph neural network classifier on relationships among domains, IP addresses, HTTPS certificate fingerprints and phishing kits to pivot from a small seed set of known indicators to new malicious infrastructure. In three case studies, the approach expanded a postal-themed phishing campaign from a few hundred domains to nearly 4,000 domains on roughly 1,200 IP addresses over the past year, and detected 3,211 phishing domains in the one-month period from Sep. 10 to Oct. 10, 2024.

Bottom line: The postal phishing campaign alone grew from a few hundred known domains to nearly 4,000 across about 1,200 IP addresses, with most domains live only briefly before attackers rotate to new ones - so blocklists built on yesterday's indicators are already behind.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026