The number of initiatives targeting malicious domains has grown within the cybersecurity world. A new project, named Shadowfall, was announced this week by RSA, in collaboration with Malwarebytes, Palo Alto Networks and Broad Analysis. The firm explained it had carried out an operation designed to damage the RIG exploit kit’s functionality.

Working Within the Shadows

RIG has been the top exploit kit since Angler was taken down, delivering both Cerber and CryptoMix ransomwares as well as the SmokeLoader backdoor. Typically, it inserts fake iframes into compromised WordPress, Joomla and Drupal sites. These cause victim browsers to land on attacker-controlled webpages.

SecurityWeek noted that RIG uses domain shadowing as one of its main characteristics. This method occurs when attackers steal actual credentials from domain owners and then use them to create subdomains pointing to malicious servers. These malicious servers hide in legitimate domains, making them unlikely to be blacklisted simply because of the suspicion of malfeasance.

According to RSA, the “shadowing activity was observed in over 30,000 subdomains total affecting over 800 domains. The active subdomains were constantly fluctuating with entries continually being added and removed in an automated fashion with an average of 900 record modifications per day.” These subdomains are short-lived, typically only existing for 24 to 48 hours.

Using the Exploit Kit’s Common Link

The domains did contain one common link: They had a high incidence of being registered by GoDaddy, one of the biggest registrars on the internet. RSA enlisted GoDaddy’s help in the project, and they worked together to identify malware-used domains.

How the threat actors actually obtain the credentials for the domains is still somewhat opaque. There have been some data dumps in the past, but RSA suggested that there was anecdotal evidence pointing to usage of Internet of Things (IoT) botnets to brute force WordPress sites, along with the use of sophisticated spear fishing campaigns.

With GoDaddy’s aid, the groups managed to remove thousands of active shadow domain resources through revocation. This action undoubtedly put a crimp into RIG’s operation, but even RSA wondered how long such an action will last. As it explained, “Determining the impact of such a takedown on the inextricable pile of ongoing ransomware, malvertising and malspam campaigns is significantly more challenging.”

More from

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…