Tessera

Join us at #BlackHaUSA 🎩 to learn more about how DomainTools can help you identify external risks, optimize your resources, and stop attacks before they happen: https://www.domaintools.com/events/black-hat-usa?utm_campaign=bh2026&utm_medium=social&utm_source=twitter

DomainTools | Black Hat USA

domaintools.com

DTI is back on the CyberWire! Our Head of Investigations and CISO, @danonsecurity.bsky.social, sat down with Dave Bittner for the Research Saturday Podcast to discuss our research on the ZionSiphon malware. Listen to the podcast on your favorite platform ⬇️ thecyberwire.com/podcasts/res... #podcast

More bark than byte.

This week we are joined by ⁠Daniel Schwalbe⁠, Chief Information Security Officer & Head of Investigations at ⁠DomainTools⁠, discussing their work on "ZionSiphon OT Malware First Attempts? Psyops? Both...

thecyberwire.com

🚰DTI just released research analyzing the recent trend of nation-state directed cyber activity against water systems. Read our investigation here ⬇️ https://dti.domaintools.com/research/threat-intelligence-report-nation-state-targeting-of-water-systems-2024-2026

DomainTools Investigations | Threat Intelligence Report: Nation-State Targeting of Water Systems 2024–2026

Explore DTI’s 2026 threat intelligence report on nation-state targeting of water systems. Learn how Volt Typhoon, Sandworm, & Iran exploit critical OT vulnerabilities.

dti.domaintools.com

DomainTools is coming to #BlackHatUSA in Las Vegas, August 1-6!🎩 🗓️Book a time to meet with our team! https://www.domaintools.com/events/black-hat-usa?utm_campaign=bh2026&utm_medium=social&utm_source=twitter

DomainTools | Black Hat USA

domaintools.com

Russian threat actors are bypassing EDR to hijack SOHO routers, bend DNS, and phish Signal/WhatsApp for long-term espionage. Read the full technical breakdown & MITRE mapping: https://dti.domaintools.com/research/threat-intelligence-report-russia-router-dns-and-messaging-layer-collection-operations

DomainTools Investigations | Threat Intelligence Report: Russia, Router, DNS, and Messaging-Layer Collection Operations

New research exposes Russian GRU (APT28) cyber operations using router compromise, DNS hijacking, and Signal/WhatsApp phishing for long-term espionage.

dti.domaintools.com

👔We’ve analyzed a highly sophisticated Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 & Entra ID. Active since Dec 2025, it smoothly bypasses traditional MFA. Read the investigation here:http://dti.domaintools.com/securitysnacks/securitysnack-hijacking-corporate-sessions

The DomainTools team is at SLEUTHCON! Stop by our booth to say hi and grab a "Zero Day" t-shirt, (and no, we won't pitch our product before you can get a shirt) ! #Cybersecurity #SLEUTHCON #InfoSec #Cybercrime

This Friday, we'll be at #SLEUTHCON ! Stop by our booth to say hi and enter our raffle to win a Nintendo Switch 2: Choose Your Own Game Bundle! #SLEUTHCON2026 #Cybersecurity #Infosec

Our team at DomainTools Investigations (DTI) took a deep dive into the ZionSiphon malware sample that’s been circling in sandboxes since 2025. Read our investigation here⬇️ http://dti.domaintools.com/research/threat-intelligence-report-zionsiphon #Cybersecurity #Malware #InfoSec #ICS

DomainTools Investigations | Threat Intelligence Report: ZionSiphon OT Malware First Attempts? Psyops? Both?

Analysis of ZionSiphon (SCADA_SecurityPatch_v8.4.exe), a .NET OT malware targeting Israeli water utilities. Discover its IOCs, targets, and flawed activation code.

dti.domaintools.com

Announcing our IP risk and IP hotlist are now available in real-time feeds, giving you access to all IP addresses to show the most dangerous and currently active infrastructure. Learn more: https://www.domaintools.com/blog/increase-threat-visibility-with-domaintools-real-time-ip-risk-feeds

📰Real Fake News: DTI’s latest research on the Russian-backed Doppelgänger campaigns breaks down the organizational structure and operational distribution model that pushes “fake news” to real news feeds. Read more: https://dti.domaintools.com/research/sda-structura-doppelganger-influence-ops

The sun is out in Seattle and the April DTI newsletter is live! 📰☀️ @danonsecurity.bsky.social breaks down the DPRK’s modular malware pipelines, the MOIS-linked Handala ecosystem, and the AI Frame campaign. Plus, Ian Campbell's monthly reading list! 📚 Catch up: dti.domaintools.com/newsletters/...

Sixteen going on Seventeen Newsletters - DomainTools Investigations | DTI

DPRK's modular malware portfolio, Iran's MOIS-linked Handala/Homeland Justice/Karma persona ecosystem, and a fake Authenticator Chrome extension dissected.

dti.domaintools.com

Government agencies are advancing Zero Trust, but are they fully leveraging DNS intelligence? DomainTools helps teams uncover adversary infrastructure before it becomes a threat. Learn how our data empowers defenders: https://www.domaintools.com/proactive-internet-intelligence-for-the-public-sector

DTI just released an analysis of the DPRK’s “Contagious Interview” campaign😷. Read the investigation to learn how the campaign targets software developers through fraudulent job interview processes.⬇️ https://dti.domaintools.com/securitysnacks/dprk-contagious-interview-developer-workflow-compromise

DomainTools Investigations | DPRK Contagious Interview: Developer Workflow Compromise

Analyze the DPRK "Contagious Interview" campaign targeting developers. Get technical deep-dives into VS Code task abuse, Node.js malware obfuscation, and a full Sigma/EDR detection pack to defend your CI/CD pipeline and identity perimeter.

dti.domaintools.com

Join our webinar: Supercharging the SOC with DomainTools MCP to learn how to supercharge your workflow using DomainTools MCP. 🗓️May 07, 2026 🕜 10:00 AM PT/1:00 PM ET 🔗www.domaintools.com/webinars/supercharging-the-soc-with-domaintools-mcp?utm_campaign=mcpwebinar&utm_medium=social&utm_source=twitter

ICYMI: IrisQL, our new query language, makes it easier than ever to share logic across teams and ticketing systems. Explore how to optimize your security stack here: https://www.domaintools.com/blog/supercharge-your-threat-investigations-with-irisql #ThreatHunting #IrisQL #Infosec #DataScience

💥Level up your threat hunting with IrisQL, our new query language for deeper, more flexible access to the Iris Investigate database. Explore the full breakdown and start optimizing your security stack here: https://www.domaintools.com/blog/supercharge-your-threat-investigations-with-irisql

Deploy clean, update dirty🧼 DTI identifies a Chrome extension tied to a malicious campaign that publishes utility software that has legitimate functionality but with pre-staged capability for malicious use Learn more: https://dti.domaintools.com/securitysnacks/the-ai-frame-campaign-continues#details

DomainTools Investigations | The AI Frame Campaign Continues

Analysis of the persistent AIFrame campaign: A fake Google Authenticator Chrome extension and 6+ related apps use "deploy clean, update dirty" tactics to steal 2FA credentials and inject malicious iframes. Learn how this operation bypasses Google’s security reviews.

dti.domaintools.com