⚠️ SW-ISAC Advisory
-
️ SW-ISAC AdvisoryThe daily data for the Russian Telegram channel spam network will no longer be updated.
The actor in question has now created over 750 accounts on 180 servers, and shows no sign of slowing down. All activity appears to be manual, but automation of new accounts could quickly overwhelm the network.
Focus will now be on investigating and labelling abandoned and unmanaged domains, and announcing those domains on the newly-released AUD denylist: https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/
-
️ SW-ISAC Advisory
The daily data for the Russian Telegram channel spam network will no longer be updated.
The actor in question has now created over 750 accounts on 180 servers, and shows no sign of slowing down. All activity appears to be manual, but automation of new accounts could quickly overwhelm the network.
Focus will now be on investigating and labelling abandoned and unmanaged domains, and announcing those domains on the newly-released AUD denylist: https://about.iftas.org/library/iftas-abandoned-and-unmanaged-domain-list/
-
-
@adulau @misp a limited description of IOCs is at https://about.iftas.org/library/known-spam-fediverse-services/#Coordinated_Network_Spam_Accounts
Some background on the ISAC: https://about.iftas.org/library/social-web-information-sharing-and-analysis-centre-sw-isac/
And I'm open to contact off-network to discuss implementing MISP, although that would need to be couched in the network's/platforms' ability to ingest and react to shared intel.
