UTA0565 pivoted typosquat domain contacted (network/DNS)

Ankit Mehta@Secvyn

•updated Sep 22, 2026•1•0•2

This rule monitors for DNS queries and network connections to known infrastructure domains associated with the threat group UTA0565. It acts as an indicator of compromise (IOC) sweep to identify internal systems attempting to communicate with malicious command-and-control (C2) servers identified by typosquatting and registration-pattern analysis.