Reposted by 𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
Computer crimes are already illegal. I do not think “we knowingly deployed software we can’t control” is a legitimate defense against break those laws.
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
@netresec.com
763 followers 285 following 91 posts
Experts in Network Forensics and Network Security Monitoring. Creators of #NetworkMiner, #PolarProxy, #FlowCarp, #CapLoader and RawCap. Website: www.netresec.com Mastodon: @netresec@infosec.exchange
![GRU unit 26165 domains:
accesscan[.]org glize[.]com
You’ve verified them, right?
You’ve verified them, right?](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:2qrgzoyfwkguclususquvdz2/bafkreieqr5ak3wrx6vczmx3gow5c4nyfa7m37e6muuo7iryw5elfoejmja)
![Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL].
*.000[.]pe
*.1cooldns[.]com
*.42web[.]io
*.4cloud[.]click
*.accesscan[.]org
*.bumbleshrimp[.]com
*.camdvr[.]org
*.casacam[.]net
*.ddnsfree[.]com
*.ddnsgeek[.]com
*.ddnsguru[.]com
*.dynuddns[.]com
*.dynuddns[.]net
*.free[.]nf
*.freeddns[.]org
*.frge[.]io
*.glize[.]com
*.great-site[.]net
*.infinityfreeapp[.]com
*.kesug[.]com
*.loseyourip[.]com
*.lovestoblog[.]com
*.mockbin[.]io
*.mockbin[.]org
*.mocky[.]io
*.mybiolink[.]io
*.mysynology[.]net
*.mywire[.]org
*.ngrok[.]io
*.ooguy[.]com
*.pipedream[.]net
*.rf[.]gd
*.urlbae[.]com
*.webhook[.]site
*.webhookapp[.]com
*.webredirect[.]org
*.wuaze[.]com
Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:2qrgzoyfwkguclususquvdz2/bafkreidsg3ldjaxglxhetka5xmbm2gc7xlthvuyoek2vmeo6ny5tsdi3di)
