DeadVax IPFS and Phishing Domain Connections
In this attack, malware is delivered through links or cloud storage. The attacker uses specific websites and services to host the fake documents. When a user clicks a link in a phishing email, they may be taken to one of these sites. The sites can look legitimate because they use well-known web infrastructure. But they are known to host the fake documents used in this campaign. Security teams should monitor for connections to these domains and URLs. Blocking or alerting on them can stop the attack before the user downloads the malicious file. This rule helps identify when a device is connecting to these known bad locations. Early detection allows teams to warn users or block the connection.
Sigma
