Internationalized Domain Names used to spread malware

As we published last year, the first Internationalized domain names (IDN) using non-Latin characters appeared on the internet; these contain characters from Cyrillic, Arabic and other languages. We also started to see some news domains using diacritics such as “, , , , , , , , , , , , , “ in their names, or accents, for instance as seen in

It’s also important to point that some browsers and mail readers aren’t prepared to show these characters correctly. A domain in Arabic such as http://وزارة-الأتصالات.مصر/ might be shown as http://xn--4gbrim.xn—-ymcbaaajlc6dj7bxne2c.xn--wgbh1c in your mailbox. We call this alternate way to show non-latin characters punycode.

During our regular monitoring of malicious activities in Brazil, we discovered an interesting and legitimate URL shortener service which is using the diacritics “.” in his name:

URL shortener service using diacritic symbol

And everybody knows that cybercriminals love to use URL shortener services. In this case, there’s no exception – various Brazilian bad guys started to use this service to decrease the size of URLs in phishing messages and also to rise the curiosity of users, presenting a URL with accents:

Malicious e-mail using a link with diactric symbol

The message above shows a link pointing to a very common Brazilian trojan banker detected as Trojan-Downloader.Win32.Delf.bbwp.

So, when receiving e-mail messages, be careful with short links, even those showing odd accents and non-latin characters!

Internationalized Domain Names used to spread malware

Your email address will not be published.



Andariel deploys DTrack and Maui ransomware

Earlier, the CISA published an alert related to a Stairwell report, “Maui Ransomware.” Our data should openly help solidify the attribution of the Maui ransomware incident to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly.

APT trends report Q2 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q2 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox