DomainTools Investigations analyzed infrastructure and operational profiles for Salt Typhoon. Our research includes crucial intelligence for attribution, detection, and threat modeling. Read more here➡️ dti.domaintools.com/inside-salt-... #ThreatIntel #SaltTyphoon #Cybersecurity #NationStateAPT

Football season is back, and so are the scammers! 🏈 Learn how to avoid activation scams spoofing services like ESPN & CBS, and get essential security tips for organizations and end-users. Read our latest research today: https://bit.ly/4nr2o0W

Steve Behm at #splunkconf25 shared a 2-year investigation into attacks on USPS & Amazon. His talk highlighted how to use Splunk and DomainTools to detect DGA domains and automate domain discovery. #Cybersecurity #ThreatIntelligence #Splunk #Phishing

New research raises questions about PoisonSeed using TTPs similar to SCATTERED SPIDER. The DTI team identified 21 new malicious domains spoofing SendGrid and using fake Cloudflare CAPTCHAs to harvest credentials: https://bit.ly/46w63on #ThreatIntel #PoisonSeed #SCATTEREDSPIDER

Kick off #splunkconf25 today at 204AB and check out Steven Behm's session summarizing a two-year investigation into attacks on USPS and Amazon by the actor Chenlun/Sinkinto01, using passive DNS data in Splunk Enterprise Security. https://conf.splunk.com/sessions/catalog.html?search=Behm#/

With our new Feed API, security teams can get near-real-time domain intelligence to prevent & respond to threats faster. Learn how to integrate the Newly Observed Domains feed into Splunk for use cases like proactive threat blocking & brand protection: https://bit.ly/4lZwFCE

The "Kim" leak exposes a DPRK APT expanding operations into Taiwan & targeting identity systems. Our analysis provides IOCs & defensive guidance for analysts & SOC teams: https://dti.domaintools.com/inside-the-kimsuky-leak-how-the-kim-dump-exposed-north-koreas-credential-theft-playbook/

We are thrilled to announce that @neurovagrant.bsky.social‬ is speaking at ‪@pancakescon.com! Catch his talk on how investigative journalists use domain & DNS data to uncover the truth, and why creative play is a secret weapon for infosec pros: pancakescon.com/2025-confere...

Our 2025 Schedule is now live! pancakescon.com/2025-confere... Congratulations to: jodiem.bsky.social @dotdot.horse neurovagrant.bsky.social @t-dye.bsky.social @wildpark.bsky.social @tindrasgrove.com @vamagabyte @winterknight.net @redteamwrangler.bsky.social @hecksec.com

Dive into this week's essential reading list. Discover new research from #blackhat & #defcon, including deep dives on #VexTrio and lessons from a #Kaseya hacker. Learn how AI impacts both defenders and attackers. https://dti.domaintools.com/cybersecurity-reading-list-week-of-2025-08-25/

Just dropped: Our CISO's monthly newsletter! 📰 This edition shares insights from Hacker Summer Camp and new research on DPRK infiltrations, malware-as-a-service & a resurfaced SpyNote campaign: https://bit.ly/3Vlr4vC #Cybersecurity #InfoSec #ThreatIntelligence #DEFCON #BlackHat

Thank you, Dr. Renée Burton, for your incredible work making the digital world safer! As VP of infoblox.bsky.social Threat Intel, she & her team exposed VexTrio, a massive global ad fraud and scam operation Learn more: https://thecyberwire.com/podcasts/research-saturday/390/notes

A new #SpyNote report is out! 🚨 Dive into the tactics of this Android RAT campaign, from dynamic payload decryption to new obfuscation methods. Learn how threat actors are using deceptive Google Play Store clones to target users https://dti.domaintools.com/spynote-malware-part-2/

A new #SpyNote report is out! 🚨 Dive into the tactics of this Android RAT campaign, from dynamic payload decryption to new obfuscation methods. Learn how threat actors are using deceptive Google Play Store clones to target users https://dti.domaintools.com/spynote-malware-part-2/

Recent DTI research tracked a trojan using hosted PowerShell scripts, uncovering bulletproof hosting services and how #LummaStealer remains a threat. Read the full report: https://dti.domaintools.com/hunting-for-malware-networks/ #Cybersecurity #ThreatIntel #Malware #BlueTeam