Tag: domain impersonation

3 Attack Reports | 0 Vulnerabilities

Attack reports

Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait

An ongoing phishing campaign targeting Kuwait's fisheries, telecommunications, and insurance sectors has been identified, utilizing over 100 domains for credential harvesting. The operation, observed since early 2025, employs cloned login portals and impersonated web pages. The infrastructure share…
phishing
credential harvesting
telecommunications
infrastructure
insurance
domain impersonation
ssh keys
2025-05-16
fisheries
kuwait
Published: May 16, 2025
Downloadable IOCs: 77

Threat Infrastructure Uncovered Before Activation

Between November 2024 and April 2025, a set of domains and servers impersonating an Iraqi academic organization and fictitious UK tech firms were tracked. The infrastructure, while dormant, exhibited characteristics similar to APT34 (OilRig), including shared SSH keys, structured websites, and deco…
oilrig
infrastructure
apt34
domain impersonation
2025-04-22
ssh keys
pre-operational staging
http decoys
m247
Published: April 22, 2025
Downloadable IOCs: 15

Scattered Spider: Still Hunting for Victims in 2025

Scattered Spider, a notorious hacking collective, continues to actively target victims in 2025. The group has expanded its focus to include services like Klaviyo, HubSpot, and Pure Storage, while targeting high-profile brands such as Audemars Piguet, Chick-fil-A, and Twitter/X. Silent Push research…
phishing
social engineering
hubspot
2025-04-09
domain impersonation
klaviyo
spectre rat
Published: April 9, 2025
Downloadable IOCs: 57
Click here to see more Attack Reports