Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
How the Noir kit uses DNS TXT records and DoH as a dynamic infrastructure control plane Executive summary We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first valid answer. The architecture separates long-lived lure pages from short-lived operational infrastructure. Changing one TXT record…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | render-984.pages.dev | High | Score 58/100 | First seen |
| Domain | noir.black | High | Score 58/100 | First seen |
| Domain | listchoiseopenleaderboardseptember.netlify.app | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…