Learning

Through Mandiant investigation of intrusions between February 2018 and September 2020, the FLARE Advanced Practices team observed a group we track as UNC1945 compromise telecommunications companies and operate against...

Skilled adversaries can deceive detection and often employ new measures in their tradecraft. Keeping a stringent focus on the lifecycle and evolution of adversaries allows analysts to devise new...

First Seen Server Subject MD5 12/12/19 140.82.60.155:443 CN=updatemanagirus ec16be328c09473d5e5c07310583d85a 12/21/19 96.30.192.141:443 CN=cmdupdatewincom 3d4de17df25412bb714fda069f6eb27e 1/6/20 45.76.49.78:443 CN=scrservallinstinfo cd6035bd51a44b597c1e181576dd44d9 1/8/20 149.248.58.11:443 CN=updatewinlsasscom 8c581979bd11138ffa3a25b895b97cc0 1/9/20 96.30.193.57:443 CN=winsystemupdatecom e4e732502b9658ea3380847c60b9e0fe 1/14/20 95.179.219.169:443 CN=jomambabest 80b7001e5a6e4bd6ec79515769b91c8b 1/16/20 140.82.27.146:443 CN=winsysteminfocom 29e656ba9d5d38a0c17a4f0dd855b37e 1/19/20 45.32.170.9:443 CN=livecheckpointsrscom 1de9e9aa8363751c8a71c43255557a97 1/20/20 207.148.8.61:443 CN=ciscocheckapicom 97ca76ee9f02cfda2e8e9729f69bc208 1/28/20 209.222.108.106:443 CN=timesshiftscom 2bb464585f42180bddccb50c4a4208a5 1/29/20 31.7.59.141:443 CN=updatewinsoftrcom 07f9f766163c344b0522e4e917035fe1 1/29/20 79.124.60.117:443 C=US 9722acc9740d831317dd8c1f20d8cfbe 1/29/20 66.42.86.61:443 CN=lsassupdatecom 3c9b3f1e12473a0fd28dc37071168870 1/29/20 45.76.20.140:443 CN=cylenceprotectcom da6ce63f4a52244c3dced32f7164038a 1/29/20 45.76.20.140:80 CN=cylenceprotectcom da6ce63f4a52244c3dced32f7164038a 1/30/20 149.248.5.240:443 CN=sophosdefencecom e9b4b649c97cdd895d6a0c56015f2e68 1/30/20 144.202.12.197:80 CN=windefenceinfocom c6c63024b18f0c5828bd38d285e6aa58 1/30/20 149.248.5.240:80 CN=sophosdefencecom e9b4b649c97cdd895d6a0c56015f2e68 1/30/20 149.28.246.25:80 CN=lsasswininfocom f9af8b7ddd4875224c7ce8aae8c1b9dd 1/30/20 144.202.12.197:443 CN=windefenceinfocom c6c63024b18f0c5828bd38d285e6aa58 1/30/20 149.28.246.25:443 CN=lsasswininfocom f9af8b7ddd4875224c7ce8aae8c1b9dd 1/30/20 45.77.119.212:443 CN=taskshedulewincom e1dc7cecd3cb225b131bdb71df4b3079 1/30/20 45.77.119.212:80 CN=taskshedulewincom e1dc7cecd3cb225b131bdb71df4b3079 1/30/20 149.28.122.130:443 CN=renovatesystemcom 734c26d93201cf0c918135915fdf96af 1/30/20 45.32.170.9:80 CN=livecheckpointsrscom 1de9e9aa8363751c8a71c43255557a97 1/30/20 149.248.58.11:80 CN=updatewinlsasscom 8c581979bd11138ffa3a25b895b97cc0 1/30/20 149.28.122.130:80 CN=renovatesystemcom 734c26d93201cf0c918135915fdf96af 1/30/20 207.148.8.61:80 CN=ciscocheckapicom 97ca76ee9f02cfda2e8e9729f69bc208 1/31/20 81.17.25.210:443 CN=update-windcom 877bf6c685b68e6ddf23a4db3789fcaa 1/31/20 31.7.59.141:80 CN=updatewinsoftrcom 07f9f766163c344b0522e4e917035fe1 2/2/20 155.138.214.247:80 CN=cleardefencewincom 61df4864dc2970de6dcee65827cc9a54 2/2/20 155.138.214.247:443 CN=cleardefencewincom 61df4864dc2970de6dcee65827cc9a54 2/2/20 45.76.231.195:443 CN=checkwinupdatecom d8e5dddeec1a9b366759c7ef624d3b8c 2/2/20 45.76.231.195:80 CN=checkwinupdatecom d8e5dddeec1a9b366759c7ef624d3b8c 2/3/20 46.19.142.154:443 CN=havesetupnet cd354c309f3229aff59751e329d8243a 2/3/20 95.179.219.169:80 CN=jomambabest 80b7001e5a6e4bd6ec79515769b91c8b 2/3/20 140.82.60.155:80 CN=updatemanagirus ec16be328c09473d5e5c07310583d85a 2/3/20 209.222.108.106:80 CN=timesshiftscom 2bb464585f42180bddccb50c4a4208a5 2/3/20 66.42.118.123:443 CN=conhostservicecom 6c21d3c5f6e8601e92ae167a7cff721c 2/4/20 80.240.18.106:443 CN=microsoftupdateswincom 27cae092ad6fca89cd1b05ef1bb73e62 2/4/20 95.179.215.228:443 CN=iexploreservicecom 26010bebe046b3a33bacd805c2617610 2/12/20 155.138.216.133:443 CN=defenswincom e5005ae0771fcc165772a154b7937e89 2/12/20 45.32.130.5:443 CN=avrenewcom f32ee1bb35102e5d98af81946726ec1b 2/14/20 45.76.167.35:443 CN=freeallsafecom 85f743a071a1d0b74d8e8322fecf832b 2/14/20 45.63.95.187:443 CN=easytuscom 17de38c58e04242ee56a9f3a94e6fd53 2/17/20 45.77.89.31:443 CN=besttuscom 2bda8217bdb05642c995401af3b5c1f3 2/17/20 95.179.147.215:443 CN=windefenscom 57725c8db6b98a3361e0d905a697f9f8 2/17/20 155.138.216.133:443 CN=defenswincom c07774a256fc19036f5c8c60ba418cbf 2/17/20 104.238.190.126:443 CN=aaatuscom 4039af00ce7a5287a3e564918edb77cf 2/17/20 144.202.83.4:443 CN=greattuscom 7f0fa9a608090634b42f5f17b8cecff0 2/17/20 104.156.245.0:443 CN=comssitecom f5bb98fafe428be6a8765e98683ab115 2/17/20 45.32.30.162:443 CN=bigtuscom 698fc23ae111381183d0b92fe343b28b 2/17/20 108.61.242.184:443 CN=livetuscom 8bedba70f882c45f968c2d99b00a708a 2/17/20 207.148.15.31:443 CN=findtuscom 15f07ca2f533f0954bbbc8d4c64f3262 2/17/20 149.28.15.247:443 CN=firsttuscom 88e8551f4364fc647dbf00796536a4c7 2/21/20 155.138.136.182:443 CN=worldtuscom b31f38b2ccbbebf4018fe5665173a409 2/25/20 45.77.58.172:443 CN=freeoldsafecom a46e77b92e1cdfec82239ff54f2c1115 2/25/20 45.77.58.172:443 CN=freeoldsafecom a46e77b92e1cdfec82239ff54f2c1115 2/26/20 108.61.72.29:443 CN=myserviceconnectnet 9f551008f6dcaf8e6fe363caa11a1aed 2/27/20 216.155.157.249:443 CN=myserviceupdatercom 4c6a2c06f1e1d15d6be8c81172d1c50c 2/28/20 45.77.98.157:443 CN=topservicesboostercom ba4b34962390893852e5cc7fa7c75ba2 2/28/20 104.156.250.132:443 CN=myserviceboostercom 89be5670d19608b2c8e261f6301620e1 2/28/20 149.28.50.31:443 CN=topsecurityservicenet 77e2878842ab26beaa3ff24a5b64f09b 2/28/20 149.28.55.197:443 CN=myyserviceupdatercom 0dd8fde668ff8a301390eef1ad2f9b83 2/28/20 207.246.67.70:443 CN=servicesecurityorg c88098f9a92d7256425f782440971497 2/28/20 63.209.33.131:443 CN=serviceupdatesnet 16e86a9be2bdf0ddc896bc48fcdbb632 2/29/20 45.77.206.105:443 CN=myserviceboosternet 6e09bb541b29be7b89427f9227c30a32 2/29/20 140.82.5.67:443 CN=servicesboosterorg 42d2d09d08f60782dc4cded98d7984ed 2/29/20 108.61.209.123:443 CN=brainschampionscom 241ab042cdcb29df0a5c4f853f23dd31 2/29/20 104.156.227.250:443 CN=servicesboostercom f45f9296ff2a6489a4f39cd79c7f5169 2/29/20 140.82.10.222:443 CN=topservicesecuritynet b9375e7df4ee0f83d7abb179039dc2c5 2/29/20 149.28.35.35:443 CN=topservicesecurityorg 82bd8a2b743c7cc3f3820e386368951d 2/29/20 207.148.21.17:443 CN=topserviceupdatercom ece184f8a1309b781f912d4f4d65738e 2/29/20 45.77.153.72:443 CN=topservicesupdatecom 8330c3fa8ca31a76dc8d7818fd378794 3/1/20 140.82.10.222:80 CN=topservicesecuritynet b9375e7df4ee0f83d7abb179039dc2c5 3/1/20 207.148.21.17:80 CN=topserviceupdatercom ece184f8a1309b781f912d4f4d65738e 3/1/20 108.61.90.90:443 CN=topservicesecuritycom 696aeb86d085e4f6032e0a01c496d26c 3/1/20 45.32.130.5:80 CN=avrenewcom f32ee1bb35102e5d98af81946726ec1b 3/2/20 217.69.15.175:443 CN=serviceshelperscom 9a437489c9b2c19c304d980c17d2e0e9 3/2/20 155.138.135.182:443 CN=topservicesupdatescom b9deff0804244b52b14576eac260fd9f 3/2/20 95.179.210.8:80 CN=serviceuphelpercom bb65efcead5b979baee5a25756e005d8 3/2/20 45.76.45.162:443 CN=boostsecurityscom 7d316c63bdc4e981344e84a017ae0212 3/4/20 108.61.176.237:443 CN=yoursuperservicecom 7424aaede2f35259cf040f3e70d707be 3/4/20 207.246.67.70:443 CN=servicesecurityorg d66cb5528d2610b39bc3cecc20198970 3/6/20 188.166.52.176:443 CN=top-serviceboostercom f882c11b294a94494f75ded47f6f0ca0 3/7/20 149.248.56.113:443 CN=topservicehelpercom 2a29e359126ec5b746b1cc52354b4adf 3/8/20 199.247.13.144:443 CN=hakunamatatatacom e2cd3c7e2900e2764da64a719096c0cb 3/8/20 95.179.210.8:443 CN=serviceuphelpercom bb65efcead5b979baee5a25756e005d8 3/8/20 207.246.67.70:443 CN=servicesecurityorg d89f6bdc59ed5a1ab3c1ecb53c6e571c 3/9/20 194.26.29.230:443 CN=secondserviceupdatercom c30a4809c9a77cfc09314a63f7055bf7 3/9/20 194.26.29.229:443 CN=firstserviceupdatercom bc86a3087f238014b6c3a09c2dc3df42 3/9/20 194.26.29.232:443 CN=fourthserviceupdatercom 3dc6d12c56cc79b0e3e8cd7b8a9c320b 3/9/20 194.26.29.234:443 CN=sixthserviceupdatercom 951e29ee8152c1e7f63e8ccb6b7031c1 3/9/20 194.26.29.235:443 CN=seventhserviceupdatercom abe1ce0f83459a7fe9c72839fc46330b 3/9/20 194.26.29.236:443 CN=eighthserviceupdatercom c7a539cffdd230a4ac9a4754c2c68f12 3/9/20 194.26.29.237:443 CN=ninethserviceupdatercom 1d1f7bf2c0eec7a3a0221fd473ddbafc 3/9/20 194.26.29.225:443 CN=seventeenthservicehelpercom 6b1e0621f4d891b8575a229384d0732d 3/9/20 194.26.29.227:443 CN=nineteenthservicehelpercom 38756ffb8f2962f6071e770637a2d962 3/9/20 194.26.29.242:443 CN=thirdservicehelpercom 3b911032d08ff4cb156c064bc272d935 3/9/20 194.26.29.244:443 CN=tenthservicehelpercom a2d9b382fe32b0139197258e3e2925c4 3/9/20 194.26.29.226:443 CN=eighteenthservicehelpercom 4acbca8efccafd92da9006d0cc91b264 3/9/20 194.26.29.243:443 CN=ninthservicehelpercom 0760ab4a6ed9a124aabb8c377beead54 3/9/20 194.26.29.201:443 CN=secondservicehelpercom d8a8d0ad9226e3c968c58b5d2324d899 3/9/20 194.26.29.202:443 CN=thirdservicehelpercom 0d3b79158ceee5b6ce859bb3fc501b02 3/9/20 194.26.29.220:443 CN=fourservicehelpercom 831e0445ea580091275b7020f2153b08 3/11/20 207.246.67.70:80 CN=servicesecurityorg d89f6bdc59ed5a1ab3c1ecb53c6e571c 3/13/20 165.227.196.0:443 CN=twentiethservicehelpercom 977b4abc6307a9b3732229d4d8e2c277 3/14/20 45.141.86.91:443 CN=thirdservice-developercom edc2680e3797e11e93573e523bae7265 3/14/20 194.26.29.219:443 CN=firstservisehelpercom 6b444a2cd3e12d4c3feadec43a30c4d6 3/14/20 45.141.86.93:443 CN=fifthservice-developercom 60e7500c809f12fe6be5681bd41a0eda 3/15/20 45.141.86.90:443 CN=secondservice-developercom de9460bd6b1badb7d8314a381d143906 3/15/20 45.141.86.84:443 CN=firstservice-developercom 6385acd425e68e1d3fce3803f8ae06be 3/17/20 45.141.86.96:443 CN=eithtservice-developercom e1d1fb4a6f09fb54e09fb27167028303 3/17/20 45.141.86.92:443 CN=fourthservice-developercom 5b5375bf30aedfa3a44d758fe42fccba 3/18/20 45.141.86.94:443 CN=sixthservice-developercom 4d42bea1bfc7f1499e469e85cf75912c 3/18/20 108.61.209.121:443 CN=service-boostercom 692ed54fb1fb189c36d2f1674db47e45 3/18/20 134.122.116.114:443 CN=service-helpescom ad0914f72f1716d810e7bd8a67c12a71 3/18/20 209.97.130.197:443 CN=helpforyourservicecom 00fe3cc532f876c7505ddbf5625de404 3/18/20 192.241.143.121:443 CN=serviceshelpscom e50998208071b4e5a70110b141542747 3/18/20 45.141.86.95:443 CN=seventhservice-developercom 413ca4fa49c3eb6eef0a6cbc8cac2a71 3/18/20 198.211.116.199:443 CN=actionshuntercom 8e5bedbe832d374b565857cce294f061 3/18/20 45.141.86.155:443 CN=sexyserviceecom cca37e58b23de9a1db9c3863fe2cd57c 3/19/20 194.26.29.239:443 CN=eleventhserviceupdatercom 7e0fcb78055f0eb12bc8417a6933068d 3/19/20 45.141.86.206:443 CN=servicedhuntercom fdefb427dcf3f0257ddc53409ff71d22 3/19/20 45.141.86.92:443 CN=service-updateercom 51ba9c03eac37751fe06b7539964e3de 3/19/20 134.122.116.59:443 CN=servicedboostercom db7797a20a5a491fb7ad0d4c84acd7e8 3/19/20 134.122.118.46:443 CN=servicedpowercom 7b57879bded28d0447eea28bacc79fb5 3/19/20 134.122.124.26:443 CN=serviceboostnumberonecom 880982d4781a1917649ce0bb6b0d9522 3/20/20 45.141.86.97:443 CN=ninethservice-developercom e4a720edfcc7467741c582cb039f20e0 3/20/20 178.62.247.205:443 CN=top-serviceupdatercom a45522bd0a26e07ed18787c739179ccb 3/20/20 159.203.36.61:443 CN=yourserviceupdatercom 7b422c90dc85ce261c0a69ba70d8f6b5 3/20/20 134.122.20.117:443 CN=fifthserviceupdatercom 99aa16d7fc34cdcc7dfceab46e990f44 3/23/20 165.22.125.178:443 CN=servicemonsterrcom 82abfd5b55e14441997d47aee4201f6d 3/24/20 69.55.60.140:443 CN=boostyourservicecom 7f3787bf42f11da321461e6db7f295d1 3/24/20 45.141.86.98:443 CN=tenthservice-developercom eef29bcbcba1ce089a50aefbbb909203 3/26/20 178.79.132.82:443 CN=developmasterscom 5cf480eba910a625e5e52e879ac5aecb 3/26/20 194.26.29.247:443 CN=thirteenthservicehelpercom 2486df3869c16c0d9c23a83cd61620c2 5/4/20 159.65.216.127:443 CN=info-developcom 5f7a5fb72c6689934cc5d9c9a681506b 9/22/20 69.61.38.155:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gtrsqercom d37ba4a4b1885e96ff54d1f139bf3f47 9/22/20 96.9.225.144:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=hakunamancom 4408ba9d63917446b31a0330c613843d 9/22/20 96.9.209.216:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=caonimascom d921dd1ba03aaf37d5011020577e8147 9/22/20 107.173.58.176:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=chalenggescom dfeb6959b62aff0b93ca20fd40ef01a8 9/22/20 96.9.225.143:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=regindscom 05c03b62dea6ec06006e57fd0a6ba22e 9/22/20 69.61.38.156:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=errvghucom c14a892f8203a04c7e3298edfc59363a 9/22/20 45.34.6.229:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=harddaggercom 7ed16732ec21fb3ec16dbb8df0aa2250 9/22/20 45.34.6.226:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=getinformationsscom 1788068aff203fa9c51d85bf32048b9c 9/22/20 45.34.6.225:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gameleaderrcom 0fff2f721ad23648175d081672e77df4 9/22/20 107.173.58.185:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=razorsescom b960355ba112136f93798bf85e6392bf 9/22/20 107.173.58.183:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nomadfunclubcom a3d4e6d1f361d9c335effdbd33d12e79 9/22/20 107.173.58.175:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bouthscom e13fbdff954f652f14faf11b735c0ef8 9/22/20 185.184.223.194:443 C=US,ST=CA,L=Texas,O=lol,OU=,CN=regbedcom 67310b30bada4f77f8f336438890d8f2 9/22/20 109.70.236.134:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=vnuretcom ae74cbb9838688363b7928b06963c40a 9/23/20 64.44.131.103:443 C=US,ST=TX,L=Texas,O=serviceswork,OU=,CN=servicesworknet af518cc031807f43d646dc508685bcd3 9/23/20 69.61.38.157:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=moonsharddcom c8fd81d6d3c8cbb8256c470a613a7c7b 9/23/20 193.142.58.129:443 C=US,ST=TX,L=Texas,O=zapored,OU=,CN=zaporedcom 5a22c3c8a0ed6482cad0e2b867c4c10c 9/23/20 45.34.6.223:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=hurrypottercom bf598ba46f47919c264514f10ce80e34 9/23/20 107.173.58.179:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=biliyilishcom 1c8243e2787421373efcf98fc0975031 9/23/20 45.34.6.222:443 C=US,ST=TX,L=Texas,O=dagger,OU=,CN=daggerclipcom 576d65a68900b270155c2015ac4788bb 9/23/20 107.173.58.180:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=blackhoallcom 69643e9b1528efc6ec9037b60498b94c 9/23/20 107.173.58.182:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=checkhunterrcom ca9b7e2fcfd35f19917184ad2f5e1ad3 9/23/20 45.34.6.221:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=check4listcom e5e0f017b00af6f020a28b101a136bad 9/24/20 213.252.244.62:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=ayiyascom 8367a1407ae999644f25f665320a3899 9/24/20 185.25.50.167:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=chainnsscom 34a78f1233e53010d29f2a4fa944c877 9/30/20 88.119.171.75:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=martahzzcom eaebbe5a3e3ea1d5992a4dfd4af7a749 10/1/20 88.119.171.74:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=jonsonsbabyycom adc8cd1285b7ae62045479ed39aa37f5 10/1/20 88.119.171.55:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=tiancaiicom bfe1fd16cd4169076f3fbaab5afcbe12 10/1/20 88.119.171.67:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=cantlieecom c8a623eb355d172fc3e083763934a7f7 10/1/20 88.119.171.76:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=realgamesscom 0ac5659596008e64d4d0d90dfb6abe7c 10/1/20 88.119.171.68:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=maybebaybecom 48003b6b638dc7e79e75a581c58f2d77 10/1/20 88.119.171.69:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=saynoforbubblecom 5c75a6bbb7454a04b9ea26aa80dfbcba 10/1/20 88.119.171.73:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=chekingkingcom e391c997b757424d8b2399cba4733a60 10/1/20 88.119.171.77:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=wondergodstcom 035697cac0ee92bb4d743470206bfe9a 10/1/20 88.119.171.78:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=zetrexxcom fc133bed713608f78f9f112ed7498f32 10/1/20 213.252.244.38:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=mountasdcom 8ead6021e2a5b9191577c115d4e68911 10/1/20 107.173.58.184:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=pudgeeecom 1c9949d20441df2df09d13778b751b65 10/1/20 88.119.174.109:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=loockfinderrscom c0ddfc954aa007885b467f8c4f70ad75 10/1/20 88.119.174.110:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=puckhunterrrcom ee63098506cb82fc71a4e85043d4763f 10/1/20 88.119.174.114:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=voiddascom 422b020be24b346da826172e4a2cf1c1 10/1/20 88.119.174.116:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sibalsakiecom 8d8f046e963bcd008fe4bbed01bed4c8 10/1/20 88.119.174.117:443 C=US,ST=TX,L=TExas,O=lol,OU=,CN=rapirasacom c381fb63e9cb6b0fc59dfaf6e8c40af3 10/1/20 88.119.174.118:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=raidbossacom add6b742d0f992d56bede79888eef413 10/1/20 88.119.174.119:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=lindasakcom 9bbd073033e34bfd80f658f0264f6fae 10/1/20 88.119.174.121:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bithunterrcom 9afef617897e7089f59c19096b8436c8 10/1/20 88.119.174.120:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=giveaseescom 3f366e5f804515ff982c151a84f6a562 10/1/20 88.119.174.107:443 C=US,ST=TX,L=Texas,O=office,OU=,CN=shabiherecom c2f99054e0b42363be915237cb4c950b 10/1/20 88.119.174.125:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=tarhungangstercom 4ac8ac12f1763277e35da08d8b9ea394 10/1/20 88.119.174.126:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=imagoddcom 7080547306dceb90d809cb9866ed033c 10/1/20 88.119.174.127:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=raaidbosscom 03037dff61500d52a37efd4b4f520518 10/1/20 88.119.174.128:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sunofgoddcom 959bed7a2662d7274b303f3b120fddea 10/1/20 213.252.244.126:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=hungrrybabycom 1d28556cc80df9627c20316358b625d6 10/1/20 213.252.244.170:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=loxlivercom 85e65803443046f921b9a0a9b8cc277c 10/1/20 213.252.246.154:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicegungstercom 9df6ba82461aa0594ead03993c0e4c42 10/5/20 5.2.64.113:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=qasckercom 18aadee1b82482c3cd5ebe32f3628f3f 10/7/20 5.2.79.122:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=cheapshhotcom 94bc44bd438d2e290516d111782badde 10/7/20 88.119.171.94:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=havemostscom f0ede92cb0899a9810a67d716cdbebe2 10/7/20 5.2.64.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=mixunderaxcom e0f9efedd11d22a5a08ffb9c4c2cbb5a 10/7/20 5.2.64.135:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bugsbunnyycom 4aa2acabeb3ff38e39ed1d840124f108 10/7/20 5.2.72.202:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sweetmonsterrcom c04034b78012cca7dcc4a0fb5d7bb551 10/7/20 88.119.175.153:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=zhamehardencom 2670bf08c43d995c74b4b83383af6a69 10/7/20 213.252.245.71:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=serviceboosterrcom 127cc347b711610c3bcee434eb8bf822 10/7/20 213.252.246.144:443 C=US,ST=TX,L=Texas,O=US,OU=,CN=servicewikiicom b3e7ab478ffb0213017d57a88e7b2e3b 10/7/20 5.2.64.149:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=sobcasecom 188f603570e7fa81b92906af7af177dc 10/7/20 5.2.64.144:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=unlockwsacom 22d7f35e624b7bcee7bb78ee85a7945c 10/7/20 88.119.174.139:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=serviceupdattercom 12c6e173fa3cc11cc6b09b01c5f71b0c 10/7/20 88.119.174.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-boosterrcom 28435684c76eb5f1c4b48b6bbc4b22af 10/7/20 88.119.175.214:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=dotmaingamecom 9c2d64cf4e8e58ef86d16e9f77873327 10/7/20 5.2.72.200:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=wodemayaacom f6f484baf1331abf55d06720de827190 10/7/20 5.2.79.10:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=hybriqdjscom d8eacda158594331aec3ad5e42656e35 10/7/20 5.2.79.12:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gunsdragcom 29032dd12ea17fc37ffff1ee94cc5ba8 10/7/20 5.2.79.121:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=gungameoncom eaf32b1c2e31e4e7b6d5c3e6ed6bff3d 10/7/20 5.2.64.174:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=quwasdcom 442680006c191692fcc3df64ec60d8fa 10/7/20 5.2.64.172:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=remotessacom 0593cbf6b3a3736a17cd64170e02a78d 10/7/20 5.2.64.167:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=secondlivvecom 38df81824bd8cded4a8fa7ad9e4d1f67 10/7/20 5.2.64.182:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=luckyhunterrscom 99dbe71ca7b9d4a1d9f722c733b3f405 10/7/20 88.119.171.97:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicesupdatercom 7d7199ffa40c50b6e5b025b8cb2661b2 10/7/20 88.119.171.96:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicemountcom f433d25a0dad0def0510cd9f95886fdb 10/7/20 96.9.209.217:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=fastbloodhuntercom e84c7aa593233250efac903c19f3f589 10/7/20 69.61.38.132:443 C=US,ST=CA,L=Mountainvew,O=Office,OU=,CN=kungfupandasacom e6e80f6eb5cbfc73cde40819007dcc53 10/13/20 45.147.230.131:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bakcup-monstercom 4fdeab3dad077589d52684d35a9ea4ab 10/13/20 45.147.229.92:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bakcup-checkercom b70cdb49b26e6e9ba7d0c42d5f3ed3cb 10/13/20 45.147.229.68:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup-simplecom 57024c1fe5c4acaf30434ba1f58f9144 10/13/20 45.147.229.52:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup-leadercom ec5496048f1962494d239d377e53db0c 10/13/20 45.147.229.44:443 C=US,ST=TX,L=Texsa,O=lol,OU=,CN=backup-helpercom 938593ac1c8bdb2c5256540d7c8476c8 10/14/20 45.147.230.87:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nasmastrservicecom cced46e0a9b6c382a97607beb95f68ab 10/14/20 45.147.230.159:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-leadercom e912980fc8e9ec1e570e209ebb163f65 10/14/20 45.147.230.141:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-checkercom 39d7160ce331a157d3ecb2a9f8a66f12 10/14/20 45.147.230.140:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-simple-helpercom d9ca73fe10d52eef6952325d102f0138 10/14/20 45.147.230.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-leadercom 920d04330a165882c8076c07b00e1d93 10/14/20 45.147.230.132:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=boost-servicesscom 771463611a43ee35a0ce0631ef244dee 10/14/20 45.147.229.180:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=elephantdrrivecom 1e4a794da7d3c6d0677f7169fbe3b526 10/14/20 45.147.230.159:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-leadercom 9c7fe10135f6ad96ded28fac51b79dfd 10/15/20 45.147.230.132:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=boost-servicesscom a78c0e2920e421667ae734d923dd5ca6 10/15/20 45.138.172.95:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-hellpercom a0b2378ceae498f46401aadeb278fb31 10/16/20 108.62.12.119:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top-backuphelpercom e95bb7804e3add830496bd36664ed339 10/16/20 108.62.12.105:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=best-nascom 8d5dc95b3bd4d16a3434b991a09bf77e 10/16/20 108.62.12.114:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top-backupservicecom d5de2f5d2ca29da1724735cdb8fbc63f 10/16/20 108.62.12.116:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=bestservicehelpercom 9c7396ecd107ee8f8bf5521afabb0084 10/16/20 45.147.230.141:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-checkercom 1134a6f276f4297a083fc2a605e24f70 10/16/20 45.147.230.140:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-simple-helpercom 2150045f476508f89d9a322561b28ff9 10/16/20 45.147.230.133:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=nas-leadercom f4ddc4562e5001ac8fdf0b7de079b344 10/19/20 74.118.138.137:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top3-servicescom 75fb6789ec03961c869b52336fa4e085 10/19/20 74.118.138.115:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=simple-backupboostercom 9f5e845091015b533b59fe5e8536a435 10/19/20 108.177.235.53:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=best-backupcom 4b78eaa4f2748df27ebf6655ea8a7fe9 10/19/20 74.118.138.138:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topbackup-helpercom bcccda483753c82e62482c55bc743c16 10/21/20 45.153.241.1:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup1helpercom 672c66dd4bb62047bb836bd89d2e1a65 10/21/20 45.153.240.240:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=checktodriverscom 6825409698a326cc319ca40cd85a602e 10/21/20 45.153.240.194:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver1mastercom 7f9be0302da88e0d322e5701d52d4128 10/21/20 45.153.240.138:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=boost-yourservicecom 2c6a0856d1a75b303337ac0807429e88 10/21/20 45.153.240.136:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup1mastercom 6559dbf8c47383b7b493500d7ed76f6a 10/23/20 45.153.240.157:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver1updatercom 7bd044e0a6689ef29ce23e3ccb0736a3 10/23/20 45.153.240.178:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1updatercom 9859a8336d097bc30e6e5c7a8279f18e 10/23/20 45.153.240.220:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driverdwlcom 43fb2c153b59bf46cf6f67e0ddd6ef51 10/23/20 45.153.240.222:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=viewdriverscom 22bafb30cc3adaa84fef747d589ab235 10/23/20 45.153.241.134:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backups1helpercom 31e87ba0c90bb38b986af297e4905e00 10/23/20 45.153.241.138:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver1downloadscom f8a14846b7da416b14303bced5a6418f 10/23/20 45.153.241.146:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicehelcom 01abdaf870d859f9c1fd76f0b0328a2b 10/23/20 45.153.241.153:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service-helcom c2eaf144e21f3aef5fe4b1502d318ba6 10/23/20 45.153.241.158:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=servicereadercom de54af391602f3deea19cd5e1e912316 10/23/20 45.153.241.167:443 C=US,ST=TX,L=Texas,O=US,OU=,CN=view-backupcom 5f6fa19ffe5735ff81b0e7981a864dc8 10/23/20 45.147.231.222:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=top3serviceboostercom ff54a7e6f51a850ef1d744d06d8e6caa 10/23/20 45.153.241.141:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1viewcom 4cda9d0bece4f6156a80967298455bd5 10/26/20 74.118.138.139:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topbackupintheworldcom e317485d700bf5e8cb8eea1ec6a72a1a 10/26/20 108.62.12.12:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topservice-masterscom e0022cbf0dd5aa597fee73e79d2b5023 10/26/20 108.62.12.121:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=topserviceboostercom 44e7347a522b22cdf5de658a4237ce58 10/26/20 172.241.27.65:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backup1servicescom cd3e51ee538610879d6fa77fa281bc6f 10/26/20 172.241.27.68:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backupmaster-servicecom 04b6aec529b3656040a68e17afdabfa4 10/26/20 172.241.27.70:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=backupmasterservicecom 200c25c2b93203392e1acf5d975d6544 10/26/20 45.153.241.139:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driver-boosterscom 9d7c52c79f3825baf97d1318bae3ebe2 10/27/20 45.153.241.14:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1updatecom 5bae28b0d0e969af2c0eda21abe91f35 10/28/20 190.211.254.154:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=driverjumpercom a1e62e7e547532831d0dd07832f61f54 10/28/20 81.17.28.70:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=service1boostcom 67c7c75d396988ba7d6cd36f35def3e4 10/28/20 81.17.28.105:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idriveheplercom 880e59b44e7175e62d75128accedb221 10/28/20 179.43.160.205:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivedownloadcom cdea09a43bef7f1679e9cd1bbeb4b657 10/28/20 179.43.158.171:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivefindercom 512c6e39bf03a4240f5a2d32ee710ce5 10/28/20 179.43.133.44:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivedwncom 87f3698c743f8a1296babf9fbebafa9f 10/28/20 179.43.128.5:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idrivecheckcom 6df66077378c5943453b36bd3a1ed105 10/28/20 179.43.128.3:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idriveupdatecom 9706fd787a32a7e94915f91124de3ad3 10/28/20 81.17.28.122:443 C=US,ST=TX,L=Texas,O=lol,OU=,CN=idriveviewcom 0e1b0266de2b5eaf427f5915086b4d7c

We are thrilled to announce the conclusion of the seventh annual Flare-On challenge. This year proved to be the most difficult challenge we’ve produced, with the lowest rate of...

Mandiant Threat Intelligence recently promoted a threat cluster to a named FIN (or financially motivated) threat group for the first time since 2017. We have detailed FIN11's various tactics, techniques...

Image parsing and rendering are basic features of any modern operating system (OS). Image parsing is an easily accessible attack surface, and a vulnerability that may lead to remote code...

Mandiant has seen an uptick in incidents involving Microsoft 365 (M365) and Azure Active Directory (Azure AD). Most of these incidents are the result of a phishing email coercing...

Graphology of an Exploit – Hunting for exploits by looking for the author’s fingerprints Research by: Itay Cohen, Eyal Itkin In the past months, our Vulnerability and Malware Research teams joined efforts...

Firefox for Android LAN-Based Intent Triggering Exploit research and development by Chris Moberly (Twitter: @init_string) Overview The SSDP engine in Firefox for Android (68.11.0 and below) can be tricked into triggering Android...

The AES-GCM-256 key is stored and generated by WhatsApp server and is sent to the client. When a user signs in to new device, it retrieves the key from the server...