Heads up on some suspicious domains spoofing UKR organizations registered in the last year:
cubenergy-my-sharepoint[.]com
dpkshodnya-mysharepoint[.]com
kub-gas[.]com
kvatral95[.]com
my-ukr[.]net
More context in @ThreatConnect: app.threatconnect.com/auth/campaign/… (1/6)
cubenergy-my-sharepoint[.]com
dpkshodnya-mysharepoint[.]com
kub-gas[.]com
kvatral95[.]com
my-ukr[.]net
More context in @ThreatConnect: app.threatconnect.com/auth/campaign/… (1/6)
Relevant hosting IPs:
91.132.139[.]155
184.164.139[.]238
94.158.245[.]28
185.174.174[.]34
Also mail server mail.kvatral95[.]com is hosted on a probable dedicated server at 45.89.175[.]235. (2/6)
91.132.139[.]155
184.164.139[.]238
94.158.245[.]28
185.174.174[.]34
Also mail server mail.kvatral95[.]com is hosted on a probable dedicated server at 45.89.175[.]235. (2/6)
Identified registrants:
tgamelin@barid[.]com
isobelmoss@barid[.]com
fvjdjf3@barid[.]com (3/6)
tgamelin@barid[.]com
isobelmoss@barid[.]com
fvjdjf3@barid[.]com (3/6)
Important to note that at this time I don't know the extent to which, if any, this infrastructure has been used maliciously. (4/6)
There are some non-unique registration and certificate consistencies amongst the domains, like use of Barid emails to register some of them. In another instance, per @urlscanio, one domain redirected to a URL containing a similar string compared to one of the other domains. (5/6)
That said, at this time I can't definitively say that the all domains and infrastructure mentioned above are related to the same actor. (6/6)
