Profile picture
Kyle Ehmke
@kyleehmke
, 3 tweets, 2 min read Read on Twitter
Some possible APT34 domains to tack on to those included in the below FireEye report:
- fuktheme[.]com
- goosegoosecome[.]com
- hugebricks[.]com
- offturn[.]com

fireeye.com/blog/threat-re…

More info in @ThreatConnect: app.threatconnect.com/auth/incident/…
@ThreatConnect These domains have similar registration and hosting characteristics compared to some of those listed in the FireEye report. However, the consistencies are not definitive in terms of attribution, therefore the "possible" association.
Another domain, jobs-datastax[.]com, most likely is associated with APT34 based on co-location with cam-research-ac[.]com (from the FireEye report) at 23.106.215[.]113.

I don't have insight into whether or how the additional domains in this thread have been used in operations.
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Kyle Ehmke
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @kyleehmke see all

Profile picture
Kyle Ehmke
@kyleehmke
On the info ops front, the Facebook page for The Right News seemingly serves as an echo chamber for The Daily Wire. Based on that page and WHOIS history for therightnews[.]net, The Right News probably is actively working on behalf of The Daily Wire without openly stating so. 1/15
In terms of background, The Right News' Facebook page was created on 11/22/13, has over 193k followers, and claims to be a Media/News company. The page posts political commentary, conservative articles, and memes. 2/15
The website listed on The Right News' Facebook page -- therightnews[.]net -- was also registered on 11/22/13 using privacy protection. Historical versions of the domain show that it was used similarly -- to share conservative, political commentary. 3/15
Read 16 tweets

Related threads

Profile picture
Andrew Thompson
@QW5kcmV3
[X] State-nexus use of publicly available tools. OVERRULED.🔥
[X] For-profit threat actors expanding their modus operandi to include interactive ransomware deployment. PICK-SIX.🔥
[X] State-nexus use of social media to engage a target, circumventing email detection. HARD PASS. 🔥
fireeye.com/blog/threat-re…
fireeye.com/blog/threat-re…
Read 5 tweets
Profile picture
Ashton Pittman
@ashtonpittman
Report: Rep. David Stringer on child sex trafficking: “I don't like to demonize it”

"If an uncle takes his niece or nephew to a playground, & they go on the merry-go-round & have some ice cream, & then do their thing, that’s just part of the experience." azcentral.com/story/news/pol…
Rep. David Stringer resigned last week, just before a report surfaced that he was arrested in the 1980s on suspicion of paying children for sex.
In the video, a woman suggests Stringer should ask the speaker about child trafficking; he says he doesn't think sex trafficking is a concern. "I don't like to demonize it” he says, adding that there are "a lot of 15-year-old prostitutes." He laughs after making that comment.
Read 7 tweets
Profile picture
nick
@3dRailForensics
Although #FIN10 achieved some success targeting the 🇨🇦 casino and mining industry, @FireEye hasn't discussed the actor much since the June, 2017 blog article fireeye.com/blog/threat-re…, because, well… the techniques are a bit abecedarian. (h/t thesaurus.com).
FIN10 has gone from targeting those industries, stealing PII and extorting victims for BTC, to posting particularly lame, decimal encoded phishing lures to Canadian stock market forums, directing victims to EMPIRE downloads. Decimal encoded URLs are a consistent FIN10 TTP.
To lend some legitimacy to the phishing lures, FIN10 registers masquerade domains and establishes websites using scrapped source code from legitimate domains. #trashtics
Read 9 tweets
Profile picture
Christopher Glyer
@cglyer
Long rumored @TheJusticeDept indictment of #APT10 is out. sc.cnbcfm.com/applications/c…
Here are my observations/highlights from reading the indictment (channeling my inner @pwnallthethings):
-the indictment indicates #APT10 operations started in 2006 and went through 2018. The 2006 activity was likely focused on US Government, Military, and defense contractors

1/n
Interestingly the indictment calls out multiple government organizations by name that were victims including:
@NASAGoddard, @NASAJPL, @LLNL, and the @USNavy

2/n
Read 24 tweets
Profile picture
Josh Russell
@josh_emerson
Facebook made the announcement Tuesday evening. The pages were identified by Facebook after a tip from cybersecurity firm @FireEye

Facebook finds disinformation campaigns run from Russia and Iran cnnmon.ie/2BzHbzU via @CNNMoney
August 21, 2018

Taking Down More Coordinated Inauthentic Behavior
newsroom.fb.com/news/2018/08/m…
Suspected Iranian Influence Operation Leverages Network of Inauthentic News Sites & Social Media Targeting Audiences in U.S., UK, Latin America, Middle East
August 21, 2018 | by FireEye Intelligenfireeye.com/blog/threat-re…SLOt
Read 44 tweets
Profile picture
Joe Truzman
@Jtruzmah
#Report #Thread
1/5
 This young man is Muhammad Sharif Badwan. He was killed East of #Gaza City at the Karni crossing after being shot in the chest by #IDF gunfire on Friday afternoon. #Israel
2/5
 Many news sites refer to Badwan as either a protestor or a demonstrator who was shot and killed by the #IDF. The photo on the left, from the DailyMail, states Badwan is a protestor. The photo on the right from CGTN states Badwan is a protestor as well.
3/5
 The problem is Badwan wasn’t there to protest in the way most people think. This video was taken Friday afternoon at the Karni crossing where Palestinians were clashing w/ #IDF soldiers. At the end, you can see Badwan being evacuated after getting shot by the #IDF.
Read 5 tweets

Trending hashtags

#Singapore #investigation #victims #BBC #Resist #THiNK #REDHERRING #Can #footwear #threatintel #North #tax #NeonRevolt #Facebook #Publicly #UKreferendum #google #Real #atALL #HAVEto #SoMuch #EasilyDone #aggressors #chairman #Answer
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!