Your organization’s leadership is 12 times more likely to be the target of a security incident and nine times more likely to be the target of a data breach than they were last year. Find out how they can be protected.
Read the Datasheet
Gift Cardsharks: The Massive Threat Campaigns Circling Beneath the Surface
Learn about the attack group primarily targeting gift card retailers and the monetization techniques they use.
Get the Report
Threat Hunting Workshop Series
Join one of our security threat hunting workshops to get hands-on experience investigating and remediating threats.
Attend an Upcoming Workshop
Inside Magecart: New RiskIQ & Flashpoint Research Report
Learn about the groups and criminal underworld behind the front-page breaches.
Threat Hunting Guide: 3 Must-Haves for the Effective Modern Threat Hunter
The threat hunting landscape is constantly evolving. Learn the techniques, tactics, and tools needed to become a highly-effective threat hunter.
LNKR is malware that uses browser extensions for Chrome to track browsing activities of users and overlay ads on legitimate sites. Using extensions to add code that executes in a user’s browser is a common and lucrative monetization technique on the internet, where spyware, adware, and other browser-based nuisances have thrived since the early days.
RiskIQ crawlers don’t install extensions, but the data we collect from our global discovery platform gives us unique insight into the LNKR threat. We can use known LNKR command and control (C2) domains and our Host Pairs data set, to determine if there was any inventoried infrastructure making calls to these C2 domains
Host pairs are unique relationships between pages that are observed by RiskIQ when we crawl a web page. Each pair has a direction of child or parent and a cause that outlines the relationship connection. These values provide insight into redirection sequences, dependent requests, or specific actions within a web page when it loads. What makes this data set powerful is the ability to understand relationships between hosts based on details from visiting the actual page.
Sure enough, we identified a trove of sites that had child requests making calls to LNKR C2 servers. After reviewing these sites, we found that the domains, as well as the format of the requests, matched LNKR. We were then able to determine if any of the affected parent websites existed within any of our customers’ digital asset inventory, which proved beneficial to them.
RiskIQ has the data to identify unique cutting edge attacks and the tools to comb through and assess the impact of previously unknown compromises. This ability is a distinct advantage for our customers and paired with the ability to proactively monitor for changes in our customer’s websites with JS Threats, RiskIQ is a critical piece of defense against external threats.
Our friends at RiskIQ provided this data pivot point on Yury Martyshev & some of his other registered domains. Have fun #OSINT sleuths. Now is a good time to plug @RiskIQ & @ydklijnsma. Its a fantastic threat assessment & intelligence tool #infosec #opsec
Magento Urges Users to Apply Security Update for RCE Bug - by @serghei
Via @Forbes, RiskIQ is the digital threat hunter using AI to define the future of #CyberSecurity #ThreatHunting #AttackSurfaceManagement https://t.co/cngRYJYWXe
Your attack surface today will not be your attack surface tomorrow. Securing your business now requires a new, adaptive approach. Here are the top 5 priorities for Attack Surface Management https://t.co/wZK5CotxQL
Your company's attack surface is continually evolving, and your security posture changes with it. In this blog post, find out why M&As mean acquiring not just a new company but also a whole new attack surface https://t.co/6u74UWoYDk