[HN Gopher] Mercenary mayhem: A technical analysis of Intellexa'...
       ___________________________________________________________________
        
       Mercenary mayhem: A technical analysis of Intellexa's PREDATOR
       spyware
        
       Author : DerekBickerton
       Score  : 15 points
       Date   : 2023-09-24 15:53 UTC (7 hours ago)
        
 (HTM) web link (blog.talosintelligence.com)
 (TXT) w3m dump (blog.talosintelligence.com)
        
       | LinuxBender wrote:
       | Interesting malware. It's probably a good idea to locally block
       | their IoC domains [1] in the local DNS resolver. Probably won't
       | help people using public DoH servers though.
       | 
       | [1] - https://github.com/Cisco-Talos/IOCs/tree/main/2023/05
        
         | ignoramous wrote:
         | I searched for a few domains and they indeed have been picked
         | up by multiple feeds: https://archive.vn/e8GNj
         | 
         | Cloudflare's 1.1.1.2 is also blocking those domains.
        
         | DerekBickerton wrote:
         | > block their IoC domains
         | 
         | And IoC raw IPs. Although that could break the web as IPV4
         | addresses change hands all the time, so you could overblock.
        
           | LinuxBender wrote:
           | Good point. One could minimize risk by looking up what AS#
           | each of those is under [1][2] to get an idea if one is
           | blocking a CDN at least I suppose. Time consuming but can be
           | done.
           | 
           | [1] - https://bgp.tools/
           | 
           | [2] - https://bgp.he.net/
        
       ___________________________________________________________________
       (page generated 2023-09-24 23:01 UTC)