Summary
This case study presents an analysis of currently active Kaseya command and control (C&C) server domains. It utilizes the WhoisXML API and the OSINT tool Maltego to gather and enrich data related to these domains. The document outlines the process for obtaining a WhoisXML API account and installing Maltego, which are essential for conducting thorough cybercrime research. The case study details the investigation into the Kaseya C&C server domains, providing practical cyber attack attribution details that can assist law enforcement in tracking and prosecuting the cybercriminals involved. It lists sample domain registrant email addresses associated with the Kaseya campaign, as well as the domains themselves. This information is intended to enhance the understanding of the cyber threat landscape and improve the effectiveness of threat intelligence efforts.
