Threat intelligence: leak sites and password stealers
What the daily checks of ransomware leak sites, password-stealing malware and abuse.ch mean for your domains and suppliers, and what to do.
Once a day, the Threat intelligence card of a domain asks three specialised sources whether the domain appears where attackers leave traces. The card appears once the first check has run; a source shows nothing until it is active on the service.
Ransomware leak sites
Ransomware groups publish the names of the organisations they claim to have attacked, to pressure them into paying. The source, ransomware.live, gathers these claims. We report a claim when the victim’s website is your domain or one of its subdomains: a company that only shares a word with your name is not reported.
A claim is not proof: groups sometimes lie, recycle old data or mistake one company for another. Check with your teams first. If the claim is true, this is a significant incident: open it under Incidents to follow the NIS2 deadlines.
The same check runs once a day for the suppliers you follow: a supplier claimed by a group shows a red label in the list. Ask the supplier, check what data and access they hold for you, and prepare for an interruption if you depend on them.
Computers infected by password stealers
Some malware steals the passwords, cookies and open sessions stored in a computer’s browser, and sells them. The source, Hudson Rock, counts the infected computers of employees (people whose work accounts are on your domain) and of users or customers (people with an account on your sites). We receive counts, dates and the names of sensitive applications seen in the stolen data, such as a VPN or a single sign-on portal; never an identifier or a password.
For employees: change the passwords of the accounts concerned, end their open sessions, require multi-factor authentication, and have the computers checked. A count that stays the same is old news; the card tells you when a newer infection appears.
Malicious addresses
abuse.ch lists addresses that distribute malware (URLhaus) and indicators of attacks (ThreatFox). If your domain or one of its hosts is listed, your site has probably been compromised: check the server’s files and accounts, clean them, then ask abuse.ch to remove the listing. An entry the sources stop listing disappears from the card.
Alerts
From the Solo plan, every new claim, newer infection or new listing is sent to your alert channels, once. On the free plan, the check runs once a week and the card shows the results without alerts.