3 ms·
When something like this happens, do security researchers instantly contact the hosting companies to suspend or block the domains used by the attackers?
by xinayder 7mo ago
When something like this happens, do security researchers instantly contact the hosting companies to suspend or block the domains used by the attackers?
- redrove 7mo agoFirst line of defense is the git host and artifact host scrape the malware clean (in this case GitHub and Pypi). Domains might get added to a list for things like 1.1.1.2 but as you can imagine that has much smaller coverage, not everyone uses something like this in their DNS infra.
- itintheory 7mo agoThis threat actor is also using Internet Computer Protocol (ICP) "Canisters" to deliver payloads. I'm not too familiar with the project, but I'm not sure blocking domains in DNS would help there.