In addition to the development, production and distribution of entertainment gambling and money management systems, the Group operates the well-known casino chain CASINO MERKUR-SPIELOTHEK. “ The Gauselmann Group is a family-run, internationally active company for the entertainment and leisure industry. The subsidiary focuses on the development of gaming/gambling electronics and equipment. Know I do! The “gg” sub-domain likely refers to a subsidiary Gebrüder Gauselmann ( source) who has their own domain ( ). Gg. – I didn’t know anything about the Gauselmann Group. Samsung.sk – Samsung Slovakia ( Web Site) pm – Likely Samsung Electronics Poland Manufacturing (SEPM) ( Wiki Page) Samsung-breda – Samsung Electronics Europe Logistics located in Breda, The Netherlands ( Yelp Entry) Samsung – Clearly a reference to the well-known electronics manufacture

rp – This domain is actually ambiguous because there are many “HTC Group” organizations and the well-known electronics manufacturer isn’t publicly referenced as “HTC Group” – internal domain related to Singapore Telecommunications Limited is a Singaporean telecommunications company. The three prominent geographic elements amongst the domains: Asia, Europe, and North America.This adds strength to the hypothesis that the victim list is a changing requirement set and the adversary may be satisfying a large variety of needs. The odd domain is gg. involved in gaming and gambling equipment which doesn’t have a correlation with any other victims.A large number (16 of 24 – 66%) of targets involved telecommunications and telephony.Especially strong correlation between all domains being associated with electronics and technology.While I didn’t find a correlation among them all, many of these domains were listed in leaked document/email dumps like WikiLeaks and the Panama Papers.This isn’t a clear-cut case of economic espionage because of the tendency towards telecommunications which can serve intelligence value well beyond intellectual property theft.This very strongly indicates a targeted activity rather than commodity threat. This means the adversary identified them somehow and then assigned them greater value = to recieve the second stage.

So, I went digging for about 30 minutes and here’s what I found. This list likely changed over time – and this list is only a snapshot in time, so it’s difficult to provide a complete profile of adversary interest, but it is interesting for that snapshot. Understanding these sub-domains and their role may offer more insight into the interests of the adversary. The adversary was not just interested in – but particularly the JP and AM sub-domains within Sony. While most names were familiar to myself the subdomains intrigued me. Talos released a list of domains in which victims would receive a second-stage package likely for further operations. Cisco’s Talos threat intelligence group analyzed some of the data around the CCleaner malware command and control (C2) to get deeper into the second stage. Recently, the CCleaner tool contained malware likely infecting millions. Cisco Talos CCleaner Victim Domain List ( source)

Ccleaner malware identified