{
  "name": "One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks",
  "slug": "one-step-ahead-in-cyber-hide-and-seek-automating-malicious-infrastructure-discovery-with-graph-neural-networks",
  "description": "The report discusses an automated approach using graph neural networks to proactively detect malicious infrastructure employed by threat actors in cyber attacks based on known indicators. It examines the relationships between different types of indicators, such as co-hosted domains, malware delivery URLs, and SSL certificates, which can reveal connections between seemingly unrelated infrastructure. The approach involves training a graph neural network classifier on these relationships to identify new malicious domains and infrastructure. Three case studies are presented, highlighting the effectiveness of this approach in uncovering large-scale phishing campaigns targeting postal services, financial institutions, and web skimmer operations.",
  "published": "2025-01-21T17:17:54+00:00",
  "created_at": "2025-01-21T17:17:54+00:00",
  "modified_at": "2025-01-21T17:48:10+00:00",
  "created_at_opencti": "2025-01-21T17:17:54+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-01-14",
    "2025-01-21",
    "anunak",
    "aranuk",
    "aranuk/carbanak",
    "automated detection",
    "automation",
    "carbanak",
    "domain analysis",
    "graph neural networks",
    "infrastructure discovery",
    "malicious domains",
    "phishing",
    "skimmer",
    "threat hunting",
    "web skimming"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "47.251.0.168"
      },
      {
        "id": "",
        "name": "www.deutsche-chartered-bank.cloudswt.com"
      },
      {
        "id": "",
        "name": "www.capitalxpresslogistic.live.firstnationalbank.live"
      },
      {
        "id": "",
        "name": "webmail.portal.guardiantrustbank.us"
      },
      {
        "id": "",
        "name": "usps.postscy.top"
      },
      {
        "id": "",
        "name": "truistcommercialbank.live.rhinoswiftdelivery.live"
      },
      {
        "id": "",
        "name": "hgsgbank.com.nexcreditunion.com"
      },
      {
        "id": "",
        "name": "inncbank.com.nexcreditunion.com"
      },
      {
        "id": "",
        "name": "deutsche-chartered-bank.cloudswt.com"
      },
      {
        "id": "",
        "name": "capitalxpresslogistic.live.firstnationalbank.live"
      },
      {
        "id": "",
        "name": "ftp.pristineglobalinvestmentbank.com"
      },
      {
        "id": "",
        "name": "apple.com-ticket.info"
      },
      {
        "id": "",
        "name": "apps.guardiantrustbanks.us"
      },
      {
        "id": "",
        "name": "woocomnnerce.com"
      },
      {
        "id": "",
        "name": "uspsyeay.top"
      },
      {
        "id": "",
        "name": "uspstpar.top"
      },
      {
        "id": "",
        "name": "uspsygfk.top"
      },
      {
        "id": "",
        "name": "uspsfugu.top"
      },
      {
        "id": "",
        "name": "uspsgrjp.top"
      },
      {
        "id": "",
        "name": "uspsntfj.top"
      },
      {
        "id": "",
        "name": "uspsepsu.top"
      },
      {
        "id": "",
        "name": "usps-supsrtys.top"
      },
      {
        "id": "",
        "name": "uspsftpr.top"
      },
      {
        "id": "",
        "name": "usps-supsrrne.top"
      },
      {
        "id": "",
        "name": "usps-supsrmuo.top"
      },
      {
        "id": "",
        "name": "usps-supsrrno.top"
      },
      {
        "id": "",
        "name": "usps-supsrfvw.top"
      },
      {
        "id": "",
        "name": "us-usos-qwtaz.top"
      },
      {
        "id": "",
        "name": "us-usos-qwtad.top"
      },
      {
        "id": "",
        "name": "us-usos-qwtaa.top"
      },
      {
        "id": "",
        "name": "staticlitycis.com"
      },
      {
        "id": "",
        "name": "standardcharteredbank.live"
      },
      {
        "id": "",
        "name": "pristineglobalinvestmentbank.com"
      },
      {
        "id": "",
        "name": "oceansharebank.com"
      },
      {
        "id": "",
        "name": "metropoliscapitalbank.us"
      },
      {
        "id": "",
        "name": "koreapostxt.shop"
      },
      {
        "id": "",
        "name": "koreapostxb.shop"
      },
      {
        "id": "",
        "name": "koreapostxn.shop"
      },
      {
        "id": "",
        "name": "koreapostst.shop"
      },
      {
        "id": "",
        "name": "koreapostpw.shop"
      },
      {
        "id": "",
        "name": "koreapostpu.shop"
      },
      {
        "id": "",
        "name": "koreapostpt.shop"
      },
      {
        "id": "",
        "name": "koreapostpo.shop"
      },
      {
        "id": "",
        "name": "koreapostpg.shop"
      },
      {
        "id": "",
        "name": "koreapostpf.shop"
      },
      {
        "id": "",
        "name": "koreapostpe.shop"
      },
      {
        "id": "",
        "name": "koreapostpc.shop"
      },
      {
        "id": "",
        "name": "koreapostnu.shop"
      },
      {
        "id": "",
        "name": "koreapostnp.shop"
      },
      {
        "id": "",
        "name": "koreapostni.shop"
      },
      {
        "id": "",
        "name": "koreapostmz.shop"
      },
      {
        "id": "",
        "name": "koreapostmx.shop"
      },
      {
        "id": "",
        "name": "koreapostmv.shop"
      },
      {
        "id": "",
        "name": "koreapostmk.shop"
      },
      {
        "id": "",
        "name": "koreapostma.shop"
      },
      {
        "id": "",
        "name": "koreapostge.shop"
      },
      {
        "id": "",
        "name": "jsmin.co"
      },
      {
        "id": "",
        "name": "jquerylib-min.net"
      },
      {
        "id": "",
        "name": "inposdomak.top"
      },
      {
        "id": "",
        "name": "inposdomag.top"
      },
      {
        "id": "",
        "name": "google-site-verification.com"
      },
      {
        "id": "",
        "name": "gcorpfinbank.info"
      },
      {
        "id": "",
        "name": "eurobank-stockscom.com"
      },
      {
        "id": "",
        "name": "eurobank-stocks.us"
      },
      {
        "id": "",
        "name": "cssjs.co"
      },
      {
        "id": "",
        "name": "correospanamaagobs-css.top"
      },
      {
        "id": "",
        "name": "correospanamaagobs-csx.top"
      },
      {
        "id": "",
        "name": "correospanamaagobs-csr.top"
      },
      {
        "id": "",
        "name": "correospanamaagobs-cse.top"
      },
      {
        "id": "",
        "name": "correospanamaagobs-csd.top"
      },
      {
        "id": "",
        "name": "correospanamaagobs-csc.top"
      },
      {
        "id": "",
        "name": "correoseswe.top"
      },
      {
        "id": "",
        "name": "correosespe.top"
      },
      {
        "id": "",
        "name": "correosesllr.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsz.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsy.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsx.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsu.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvst.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsp.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsi.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsl.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsh.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsg.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsf.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvse.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsd.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostvsa.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-myposts.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-myposth.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-mypostf.top"
      },
      {
        "id": "",
        "name": "correoparaguayo-myposta.top"
      },
      {
        "id": "",
        "name": "chatwareopenalgroup.net"
      },
      {
        "id": "",
        "name": "byvlsa.com"
      },
      {
        "id": "",
        "name": "theipscanner.com"
      },
      {
        "id": "",
        "name": "myscannappo.online"
      },
      {
        "id": "",
        "name": "myscannappo.info"
      },
      {
        "id": "",
        "name": "myscannappo.com"
      },
      {
        "id": "",
        "name": "myipscanner.com"
      },
      {
        "id": "",
        "name": "ipscannershop.com"
      },
      {
        "id": "",
        "name": "ipscanneronline.com"
      },
      {
        "id": "",
        "name": "advanced-ip-sccanner.com"
      },
      {
        "id": "",
        "name": "establish-coinbase.com"
      }
    ],
    "malware": [
      {
        "id": "560bfdc5-5702-49dd-93a0-b7845f663520",
        "name": "Aranuk/Carbanak",
        "slug": "aranukcarbanak"
      }
    ],
    "intrusion_sets": [
      {
        "id": "bfea1197-40fd-453b-9e29-6b30cbe08c07",
        "name": "Squeamish Libra",
        "slug": "squeamish-libra"
      }
    ],
    "attack_patterns": [
      {
        "id": "63567f6b-fd33-4e9f-b631-48dd6fd02c21",
        "name": "T1557.002"
      },
      {
        "id": "dc76fab3-7f29-4a18-93bc-9dbc56338e11",
        "name": "T1584.003"
      },
      {
        "id": "7ec3a60f-8eaa-4766-ab47-1a220616a29c",
        "name": "T1584.004"
      },
      {
        "id": "ef72da1d-2eaa-4d94-8913-06978609cfb4",
        "name": "T1608.001"
      },
      {
        "id": "effdd452-1540-48f5-9fff-347c7526f6ba",
        "name": "T1583.004"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "320df345-a473-4f17-9588-6cd021c14bd3",
        "name": "T1583.003"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Dominican Republic"
      },
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "Kenya"
      },
      {
        "id": "",
        "name": "Ireland"
      },
      {
        "id": "",
        "name": "Greece"
      },
      {
        "id": "",
        "name": "South Africa"
      },
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Korea, Democratic People's Republic of"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "Australia"
      },
      {
        "id": "",
        "name": "Korea, Republic of"
      },
      {
        "id": "",
        "name": "Switzerland"
      },
      {
        "id": "",
        "name": "Spain"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "Thailand"
      },
      {
        "id": "",
        "name": "Canada"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "Mexico"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Israel"
      },
      {
        "id": "",
        "name": "United States of America"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/678fe4d214e88c02cc2cc2d5",
    "https://unit42.paloaltonetworks.com/graph-neural-networks/"
  ]
}