5 ms·
Interesting malware. It's probably a good idea to locally block their IoC domains [1] in the local DNS resolver. Probably won't help people using public DoH s
by LinuxBender 3y ago
Interesting malware. It's probably a good idea to locally block their IoC domains [1] in the local DNS resolver. Probably won't help people using public DoH servers though.
[1] - https://github.com/Cisco-Talos/IOCs/tree/main/2023/05 https://github.com/Cisco-Talos/IOCs/tree/main/2023/05
- DerekBickerton 3y ago> block their IoC domains And IoC raw IPs. Although that could break the web as IPV4 addresses change hands all the time, so you could overblock.
- LinuxBender 3y agoGood point. One could minimize risk by looking up what AS# each of those is under [1][2] to get an idea if one is blocking a CDN at least I suppose. Time consuming but can be done. [1] - https://bgp.tools/ https://bgp.tools/ [2] - https://bgp.he.net/ https://bgp.he.net/
- ignoramous 3y agoI searched for a few domains and they indeed have been picked up by multiple feeds: https://archive.vn/e8GNj https://archive.vn/e8GNj Cloudflare's 1.1.1.2 is also blocking those domains.