Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Connecting the Dots in Cyber Threat Campaigns, Part 1: Domain Name WHOIS Information

Summary: Unit 42's first post in a series on tying attacker infrastructure together explains that domain WHOIS registration data is often the starting point, since actors sometimes re-use registrant names, email addresses and contact details across multiple malicious domains. The post notes that registrant information can be forged - often only the email address is legitimate, because the actor needs it to control the domain - and that analysts must check historical WHOIS records, since domains can be revoked after registrar complaints, expire and be re-registered, or be bought through registrant services where Domain Privacy hides the end user.

What's compelling: The method works best against APT campaigns, where human habit leaves reusable WHOIS and domain-name themes, but Unit 42 notes crimeware auto-generates domains used only briefly, at a volume and turnover rate that makes this manual correlation often not worth doing.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related