Mastodawn

🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

https://www.infoblox.com/blog/threat-intelligence/inside-keitaro-abuse-a-persistent-stream-of-ai-driven-investment-scams/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

Infoblox Threat Intel May 27, 2025

Last week, Microsoft reported that their Digital Crimes Unit (DCU) and international partners disrupted Lumma Stealer by taking down 2,300 domains critical to the malware's operation. Shortly after, Palo Alto's Unit 42 reported about cyber campaigns that previously dropped Lumma Stealer are now distributing StealC infostealer payloads. We analyzed the DNS infrastructure related to the attacks and discovered a large number of malicious registered domain generation algorithm (RDGA) domains. Based on passive DNS, the threat actor that controls the infrastructure configured the domains to a staging environment via a dedicated Panama IP address (self-signed SSL) before deploying them. We identified 144 unique domains in this IP space, and all of them were detected as "suspicious" by our algorithms 1-2 months before they were activated for malicious activity.

Disrupting criminal operations is difficult and they will find ways to resurface. However, this example proves that blocking connections at the DNS level can often protect users against the new versions before they emerge. The infostealer actors made a quick turn, but we were already blocking their path. Our specialty is in DNS analytics, so we use DNS signatures, as opposed to malware signatures, for preemptive security. We love this stuff.

Here are some examples of the RDGA domains:
2323dot2[.]cfd, 2323dot2[.]cyou, 2323dot2[.]my, 232pip1[.]my, 232pip1[.]sbs, 832pip[.]cfd, 832pip[.]cyou, 832pip[.]my, 832pip[.]sbs, b3cloud[.]cfd, b3cloud[.]cyou, b3cloud[.]my, b3cloud[.]sbs, bin48[.]cfd, bin48[.]cyou, bin48[.]my, bin898293[.]cfd, bin898293[.]cyou, bin898293[.]my, bin898293[.]sbs, bit7dl[.]cfd, bit7dl[.]cyou, bit7dl[.]my, bit7dl[.]sbs, bot113cloud[.]cfd, bot113cloud[.]cyou, bot113cloud[.]my

These campaigns share similar TTPs with those that we reported several months ago. The threat actor that we discussed in this post (https://infosec.exchange/@InfobloxThreatIntel/114027715851469775) also distributed Lumma Stealer and used RDGA domains, but incorporated additional components, such as traffic distribution systems (TDS), web trackers, and cloakers.

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #infostealer #lummastealer #stealc #tds #tracker #cloaker #rdga

Infoblox Threat Intel (@[email protected])

Attached: 1 image Lumma Stealer is currently one of the most popular malware. Campaigns involving this info stealer have a notable presence in DNS. We’ve been tracking a threat actor that deploys large number of domains to advertise file share links dropping Lumma Stealer. These campaigns are interesting because the actor uses traffic distribution system (TDS), cloaking, and web tracking technology (e.g. Matomo, Bablosoft) to hide and protect the malicious content. Here are recent examples of the TDS and landing page domains. :::TDS + Cloaking::: am4[.]myidmcrack[.]site bjnhuy[.]shop filefetch[.]click mplopop[.]shop oyoclean[.]sbs psldi3z[.]com readyf1[.]click volopi[.]cfd :::Landing Page::: 14redirect[.]cfd downf[.]lol fbfgsnew[.]com icjvueszx[.]com lkjpoisjnil[.]site sikoip[.]cfd zulmie[.]cfd An attack that we investigated today showed a new Lumma Stealer payload and C2 domain that is only a day old. :::Lumma Stealer executable SHA256::: df148680db17e221e6c4e8aed89b4d3623f4a8ad86a3a4d43c64d6b1768c5406 :::Text sites containing Lumma Stealer configuration details::: hXXps://rentry[.]co/feouewe5/raw hXXps://pastebin[.]com/raw/uh1GCpxx :::Newly created Lumma Stealer C2::: hXXps://urbjanjungle[.]tech/api #malware #lummastealer #c2 #tds #tracker #cloaking #dns #mastodon #threatintel #cybercrime #threatintelligence #cybersecurity #infosec #infoblox #infobloxthreatintel

Infosec Exchange

akino (taco)

Jul 13, 2023

“N-no, no, no *no*!” You protest, your hands trying to pull off a pill bottle lid the size of a manhole cover. But the damage was done… you had become small, once again. Your method of maintaining a standard size was through time-released medication. While modern medicine was a marvel, nothing could keep you away from your natural height of a dozen centimeters (shy of five inches) tall forever. And these child proof locks were more than child proof, they were *you* proof, at this size. Can’t squeeze the bottle as much as they require for you to open it.

Luckily, you left your phone on the counter and you remembered your passcode. Your tiny hands press against the screen in frustration as you navigated your phone, now the size of a television screen. A few taps against the bright glass lead you to your favorites and to speed dial your friend.

“Hello?” They chime, picking up after what appears like an eternity.

“Hey…” You reply, sighing once more. “It happened again.” You can hear your voice at a smaller pitch now, and it’s… belittling, to say the least.

“Oh gosh, really?!” There’s almost elation in her voice. Your friend realizes that they’re not supposed to be excited about this, and their tone changes. “U-uhm, I’ll be right over to help you get your pills out. Are you safe?”

“Yeah, I’m on the counter…” You sigh.

“Okay. Be there soon!” Your friend hangs up. They know where the spare key is. For now, you’re stranded once again. However, bigger you had left crumbs out that you can now eat while you wait for your friend to arrive. You wonder they’ll stay to watch you grow back to standard size again. It’s embarrassing, to say the least.

At least you managed to climb up onto the counter in time. This isn’t as bad as the floor.

You hate the floor.

#micro #cloaker #microfic #shrinking #medication

Gregori Fabre Aug 6, 2019

#cloaker – Un outil pour chiffrer et déchiffrer vos documents sous Windows, Linux et Mac #korben https://korben.info/cloaker-un-outil-pour-chiffrer-et-dechiffrer-vos-documents-sous-windows-linux-et-mac.html

Cloaker – Un outil pour chiffrer et déchiffrer vos documents sous Windows, Linux et Mac

Le chiffrement c’est marrant et avec la multitude des outils disponibles aujourd’hui c’est même devenu un jeu d’enfant. En voici un nouveau baptisé Cloaker qui se trouve êtr…