SecuriTricks - infrastructure discovery

Illuminating Transparent Tribe

This analysis explores the infrastructure of APT36, also known as Transparent Tribe, using passive DNS and host response history. Starting with indicators from a CyberXTron report on a targeted phishing attack against Indian Government and Defense, the investigation expands through DNS history, IP …

phishing

defense

apt36

passive dns

infrastructure discovery

Published: June 3, 2025

Downloadable IOCs: 3

Pulling the Threads on the Phish of Troy Hunt

A sophisticated phishing attack targeted Troy Hunt, compromising his Mailchimp account. The analysis reveals connections to the Scattered Spider group through domain pivoting. Using Validin's DNS, host response, and registration data, dozens of related domain names were uncovered. The investigation…

phishing

threat intelligence

infrastructure discovery

Published: March 29, 2025

Downloadable IOCs: 0

One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks

The report discusses an automated approach using graph neural networks to proactively detect malicious infrastructure employed by threat actors in cyber attacks based on known indicators. It examines the relationships between different types of indicators, such as co-hosted domains, malware deliver…

graph neural networks

web skimming

infrastructure discovery

Published: January 21, 2025

Downloadable IOCs: 103

Tag: infrastructure discovery

Attack reports

Illuminating Transparent Tribe

Pulling the Threads on the Phish of Troy Hunt

One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks