Much like a roofing company chasing a hail storm, when there's a heavily publicized event, a cyber attacker will take advantage of it to seek out new victims. Therefore, cybersecurity professionals should also follow headlines when they hunt for opportunistic threat activity.
Because of the current political news, I searched for a presidential candidate's name (perhaps you've heard of her?) within our data and stumbled across a Neutrino Exploit Kit landing page. Combining the click-enticing appeal of hot-button political headlines with the perimeter-piercing capability of domain shadowing, this example had all the makings of a successful payload delivery.
This particular crawl was flagged by RiskIQ's system at multiple stages, including the ad server—which was potentially hacked, the malicious redirector, and the Neutrino EK landing page. You can view the details for each stage via the following links:
The following sequence overview gives a good idea of the events that lead to the landing page:
Here's the Neutrino code snippet:
Originally, it was thought that this domain was resolving briefly to a Russian IP address, but after looking inside PassiveTotal, RiskIQ's proprietary threat research tool, it looks like the actor just switched IP addresses and is continuing to operate on the new infrastructure:
Taking a step back, let's look at the child pairs for the second-level domain using PassiveTotal's Maltego transforms. It shows several alleged domains shadowing victims while the diagram illustrates that an iframe is pushing traffic to these domains—similar to the sequence above.
For a list of web components, which commonly reveal additional A records, visit PassiveTotal today (free accounts are welcome):
So there you have it—this campaign is still fresh, and we're still tracking it at RiskIQ.
To continuously monitor this threat actor's movements, go ahead and pivot around in PassiveTotal. PassiveTotal harnesses the power of big data analytics to surface the footprint of an attacker, making threat investigations and incident response quicker than ever before—we've even added new datasets and features to the platform to enhance threat analysis and data visualization.
Questions? Feedback? Email firstname.lastname@example.org to contact our research team.