An analysis of the Okenit leak revealing "Lemmings," a Russian software framework automating synthetic persona provisioning for active measures campaigns.

A leaked cache of files reveals how Bauman University’s Department No. 4 serves as a training pipeline supplying military cyber operators to GRU units APT28 and Sandworm.

Fresh from Hacker Summer Camp, Daniel Schwalbe breaks down pro-Iran cyber militias, Mexican "Cita Express" scams, and illicit IRGC financial networks.

Explore how account farmers exploit lax signup friction to inflate metrics and sell verified accounts. Discover key IOCs and mitigation strategies.

Access cybersecurity research, threat intelligence reports, SecuritySnacks, newsletters, and podcast episodes from DomainTools Investigations team.

Discover how scarcity scams exploit government service bottlenecks to commit wire fraud and identity theft. Learn the tactics behind fake fast-track portals.

June’s roundup of research - from cyberattacks on water infrastructure OT and ICS to DNS hijacking and an AiTM campaign targeting Microsoft365 users.

This week we are joined by ⁠Daniel Schwalbe⁠, Chief Information Security Officer & Head of Investigations at ⁠DomainTools⁠, discussing their work on "ZionSiphon OT Malware First Attempts? Psyops? Both...

Explore DTI’s 2026 threat intelligence report on nation-state targeting of water systems. Learn how Volt Typhoon, Sandworm, & Iran exploit critical OT vulnerabilities.

New research exposes Russian GRU (APT28) cyber operations using router compromise, DNS hijacking, and Signal/WhatsApp phishing for long-term espionage.

Analysis of ZionSiphon (SCADA_SecurityPatch_v8.4.exe), a .NET OT malware targeting Israeli water utilities. Discover its IOCs, targets, and flawed activation code.

DPRK's modular malware portfolio, Iran's MOIS-linked Handala/Homeland Justice/Karma persona ecosystem, and a fake Authenticator Chrome extension dissected.

Analyze the DPRK "Contagious Interview" campaign targeting developers. Get technical deep-dives into VS Code task abuse, Node.js malware obfuscation, and a full Sigma/EDR detection pack to defend your CI/CD pipeline and identity perimeter.

Analysis of the persistent AIFrame campaign: A fake Google Authenticator Chrome extension and 6+ related apps use "deploy clean, update dirty" tactics to steal 2FA credentials and inject malicious iframes. Learn how this operation bypasses Google’s security reviews.

Explore the evolution of MOIS-linked actors Homeland Justice, Karma, and Handala. Analysis of destructive malware, surveillance integration, and the 2026 Stryker incident.

DTI's March newsletter covers Doppelgänger disinformation infrastructure analysis, Cloudflare-abusing phishing campaigns, a TLS private key exposure in Qihoo 360's AI platform, and a malicious ChatGPT ad blocker Chrome extension stealing user conversations.

Learn how DomainTools and Palo Alto Networks Cortex combine best-in-class DNS intelligence with automated playbooks and ML-powered risk scoring to help security teams detect, investigate, and respond to threats faster.

Discover how Handala, Homeland Justice, and Karma function as a unified MOIS-linked cyber influence ecosystem. This threat intelligence assessment reveals how Iran uses "hack-and-leak" operations to weaponize perception over technical complexity.

Explore the DPRK’s modular malware architecture. Analyze how North Korea uses compartmentalized toolchains for espionage, crypto theft, and strategic signaling.

Capitalizing on OpenAI's new ad policy, a malicious Chrome extension masked as a ChatGPT ad blocker was quietly stealing your conversations and sending them to a Discord channel.