cloudlanecdn[.]comDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels“The malware performs DNS tunneling — using IPv6 AAAA record queries against the attacker-controlled domain “cloudlanecdn[.]com” — to refresh the Microsoft Entra ID (Azure AD) credentials it authenticates with, writing the updated values to an on-disk configuration file (logAzure.tx…”
Indicators reported together
named in the same reports- p.cloudlanecdn[.]comin 1 report
- q.cloudlanecdn[.]comin 1 report
- co[.]ilin 1 report
- 315bdba98c6fe863…88cae56d61c1in 1 report
- 1573e125197ec77d…26b46c53bd25in 1 report
- 75e51774b8f79e5f…980255621509in 1 report
- f3f3006f83047882…101bcc851da3in 1 report
- b3d0f6e4e3be395f…bc3564485effin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.