Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Domain Parking: A Gateway to Attackers Spreading Emotet and Impersonating McAfee

Summary: Unit 42 identified 5 million newly parked domains and saw 6 million parked domains change category between March and September 2020, with 1.0% moving to malicious categories, 2.6% to not-safe-for-work categories and 30.6% to suspicious categories. The domain valleymedicalandsurgicalclinic[.]com, registered July 8, 2020 and first classified as parked, hosted malware from September 14, 2020 as part of a global Emotet campaign that targeted organizations in education, government, energy, manufacturing, construction and telecommunications across the United States, United Kingdom, France, Japan, Korea and Italy.

Key Takeaway: A parked domain carries eight times the probability of a benign domain of turning non-benign, and over 25.9% of those that went malicious did so in under 10 days - so a domain your filters cleared this morning can be serving Emotet by the end of the week.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related