Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
54 IOCs
Attackers impersonate Romanian Gas Companies – OSINT Investigation
Excerpt
In this blog post, we’re going to look at a campaign that reveals recently created domains impersonating known Romanian gas companies. It all started with an ad on YouTube that featured a suspicious domain related to the legitimate RoEnergy Trade Fair. The ad was voiced in Romanian using an automatic translator. The website hosted on inf24roenergy[.]pro is shown in Figure 1. Figure 1 Using VirusTotal, we could determine which IP address the domain resolves to: Figure 2…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →54 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | desprerompetrol.pro | High | Score 58/100 | First seen |
| Domain | educationplatform.pro | High | Score 58/100 | First seen |
| Domain | mountainequ.info | High | Score 58/100 | First seen |
| Domain | smart-academy.pro | High | Score 58/100 | First seen |
| Domain | gfcostsavings.info | High | Score 58/100 | First seen |
| Domain | transgaze.pro | High | Score 58/100 | First seen |
| Domain | onehatueente.site | High | Score 58/100 | First seen |
| Domain | bogdust.top | High | Score 58/100 | First seen |
| Domain | limitedlash.info | High | Score 58/100 | First seen |
| Domain | petroledge.info | High | Score 58/100 | First seen |
| Domain | transsgaze.pro | High | Score 58/100 | First seen |
| Domain | amacointm.pro | High | Score 58/100 | First seen |
| Domain | profitpathprogram.info | High | Score 58/100 | First seen |
| Domain | rompetrolright.pro | High | Score 58/100 | First seen |
| Domain | transgasinside.info | High | Score 58/100 | First seen |
| Domain | sample-test.site | High | Score 58/100 | First seen |
| Domain | romatransgaz.pro | High | Score 58/100 | First seen |
| Domain | newsro.shop | High | Score 58/100 | First seen |
| Domain | energysphere.pro | High | Score 58/100 | First seen |
| Domain | romtransgaz.info | High | Score 58/100 | First seen |
| Domain | pipelineproconsult.info | High | Score 58/100 | First seen |
| Domain | pawfunlding.net | High | Score 58/100 | First seen |
| Domain | prooilfield.info | High | Score 58/100 | First seen |
| Domain | qwizanotes.net | High | Score 58/100 | First seen |
| Domain | inf360romenergy.pro | High | Score 58/100 | First seen |
| Domain | cainstery.info | High | Score 58/100 | First seen |
| Domain | finfreedom.info | High | Score 58/100 | First seen |
| Domain | transgazrefueling.pro | High | Score 58/100 | First seen |
| Domain | dinoautom.info | High | Score 58/100 | First seen |
| Domain | romenergy360.info | High | Score 58/100 | First seen |
| Domain | fuelingycr.info | High | Score 58/100 | First seen |
| Domain | savingspump.pro | High | Score 58/100 | First seen |
| Domain | romenergyinside.pro | High | Score 58/100 | First seen |
| Domain | newamacoin.info | High | Score 58/100 | First seen |
| Domain | inforomenergy.pro | High | Score 58/100 | First seen |
| Domain | ambeeyroma.net | High | Score 58/100 | First seen |
| Domain | protransgas.info | High | Score 58/100 | First seen |
| Domain | proromenergy.info | High | Score 58/100 | First seen |
| Domain | profuelgasadv.info | High | Score 58/100 | First seen |
| Domain | onlinecashflow.website | High | Score 58/100 | First seen |
| Domain | transgazinfo.pro | High | Score 58/100 | First seen |
| Domain | rotechnoere.info | High | Score 58/100 | First seen |
| Domain | quebossa.net | High | Score 58/100 | First seen |
| Domain | fuelefficientinrom.info | High | Score 58/100 | First seen |
| Domain | economicempowerment.pro | High | Score 58/100 | First seen |
| Domain | effectroenergy.pro | High | Score 58/100 | First seen |
| Domain | romenergy.pro | High | Score 58/100 | First seen |
| Domain | profitpath.life | High | Score 58/100 | First seen |
| Domain | bonaks.site | High | Score 58/100 | First seen |
| Domain | coursesknowledge.info | High | Score 58/100 | First seen |
| Domain | inf24roenergy.pro | High | Score 58/100 | First seen |
| Domain | oneromenergy.pro | High | Score 58/100 | First seen |
| Domain | roenergy24.info | High | Score 58/100 | First seen |
| Domain | assetadvantage.life | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…