Internationalized Domain Names used to spread malware

As we published last year, the first Internationalized domain names (IDN) using non-Latin characters appeared on the internet; these contain characters from Cyrillic, Arabic and other languages. We also started to see some news domains using diacritics such as “, , , , , , , , , , , , , “ in their names, or accents, for instance as seen in

It’s also important to point that some browsers and mail readers aren’t prepared to show these characters correctly. A domain in Arabic such as http://وزارة-الأتصالات.مصر/ might be shown as http://xn--4gbrim.xn—-ymcbaaajlc6dj7bxne2c.xn--wgbh1c in your mailbox. We call this alternate way to show non-latin characters punycode.

During our regular monitoring of malicious activities in Brazil, we discovered an interesting and legitimate URL shortener service which is using the diacritics “.” in his name:

URL shortener service using diacritic symbol

And everybody knows that cybercriminals love to use URL shortener services. In this case, there’s no exception – various Brazilian bad guys started to use this service to decrease the size of URLs in phishing messages and also to rise the curiosity of users, presenting a URL with accents:

Malicious e-mail using a link with diactric symbol

The message above shows a link pointing to a very common Brazilian trojan banker detected as Trojan-Downloader.Win32.Delf.bbwp.

So, when receiving e-mail messages, be careful with short links, even those showing odd accents and non-latin characters!

Internationalized Domain Names used to spread malware

Your email address will not be published. Required fields are marked *



GhostEmperor: From ProxyLogon to kernel mode

While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

Subscribe to our weekly e-mails

The hottest research right in your inbox