Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Pulling the Brake on the Magnitude EK Train

Summary: Unit 42 researchers identified the domain-generation pattern behind the Magnitude Exploit Kit, which uses third-level alphanumeric strings, second-level domains built from two English words, and unusual legitimate TLDs such as stream, space, review, webcam, trade, date, and party. Using a PCRE built from roughly 100,000 collected sessions, they found 1,113 unique landing pages across 1,056 unique domains, then used 223 registrant emails to enumerate 6,089 additional second-level domains for pre-emptive blocking.

Bottom line: Registration data showed one phone number tied to 1,411 domains and another to 2,421 registrations, meaning the same operators can stand up new attack infrastructure faster than blocklists are typically refreshed. The published domain list and PCREs let defenders block Magnitude EK domains before they are used in an attack rather than after.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related