ctrlINT What the industry said about every indicator, with the quote

resources.dawnnewsisl[.]comDomain

Reported by 1 independent source · first reported by Elastic Security Labs · last reported

Last reported 6 months ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “…he C2 server address that the backdoor actually communicates with is a separate C++ global string variable stored in cleartext(resources.dawnnewsisl[.]com/updtdll), which is passed directly to the function responsible for C2 communication and payload downloads.”

    Elastic Security LabsVendor
    Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER

Indicators reported together

named in the same reports
Copy these 2 indicators · defanged

Thanks — we review every report.

Report a wrong value
What is wrong with resources.dawnnewsisl[.]com here?
No account needed. We do not store your IP address.