Vigilocity’s Mythic© - Offensive Impact Platform

Vigilocity's Mythic stands at the forefront of breach intelligence, offering a cutting-edge platform that goes beyond conventional approaches to provide a materiality of breach intelligence. Mythic's innovative technology leverages machine learning to sift through vast amounts of data, identifying and prioritizing confirmed security breaches based on their material impact.

The platform's robust capabilities not only detect breaches but also offer valuable insights into the material impact of these incidents, empowering security, audit, and regulatory teams to make informed decisions and respond swiftly.

Reverse Attack Surface Analysis (RASA)

Mythic employs “Reverse Attack Surface Analysis”, or RASA, Vigilocity’s proprietary methodology, empowering security, intelligence, and risk professionals to identify emerging events, active and impending malicious cyber campaigns, and predict future outcomes with a high degree of accuracy.

The premise of the RASA methodology is quite simple: “If an adversary were to attack us, what infrastructure vulnerability would they attempt to exploit and from where and when would that exploitation originate?”

Empirical Breach Intelligence

Vigilocity's Mythic delivers empirical breach intelligence through the systematic collection, analysis, and verification of concrete evidence indicating a material breach in security. In the context of cybersecurity, a material breach signifies a significant and confirmed harmful incident that compromises the confidentiality, integrity, or availability of sensitive information or systems.

Empirical breach intelligence plays a crucial role in enhancing an organization's cybersecurity posture by enabling prompt and effective responses to security incidents. This evidence-based approach is essential for making informed decisions in the rapidly evolving landscape of cybersecurity threats.

Related Videos

Featured
Real-time Brand & Trademark Infringement Search
Brand & Trademark Infringement
Real-time Brand & Trademark Infringement Search
Brand & Trademark Infringement

Domain squatting refers to the act of registering or acquiring a domain name that is similar to an established brand, company, or trademark, with the intention of exploiting it for financial gain or disrupting the legitimate owner's online presence. In more nefarious cases, the domain is used to send phishing emails to employees, partners and customers of the legitimate brand and is commonly employed as an early stage tactic for ransomware or influence operations.

In this video, several searches of exceedingly well known brands are conducted on a corpus of enriched data spanning from January 1, 2023 through May 28, 2023. The queries and results are as follows:

  • “walmart” - 81 domains, 31 registrants, 33 email addresses, 29 locations, most recent registration May 22, 2023

  • “amazon” - 756 domains, 422 registrants, 417 email addresses, 313 locations, most recent registration May 27, 2023

  • “americanexpress” - 5 domains, 4 registrants, 4 email addresses, 4 locations, most recent registration April 30, 2023

  • “microsoft” - 123 domains, 100 registrants, 101 email addresses, 93 locations, most recent registration May 28, 2023

  • “capitalone” - 7 domains, 7 registrants, 7 email addresses, 7 locations, most recent registration April 24, 2023

  • “google” - 157 domains, 129 registrants, 132 email addresses, 114 locations, most recent registration May 28, 2023

Vigilocity’s mission is near instant notification of fraudulent domain registrations immediately followed by rapid domain takedown, mitigating further damage and disrupting the threat actor.

Read More →
Brand & Trademark Infringement
Real-time Identification of High Confidence Threat Actor Infrastructure
Threat Hunting
Real-time Identification of High Confidence Threat Actor Infrastructure
Threat Hunting

This effort began with a simple search for the most used email address for the month of May 2023 which resulted in an "@outlook.com" address. The email address was then used as a pivot in the following video.

In less than a month (starting April 25th through May 13th) the threat actor registered approximately 11,000 domains which would equate to nothing less than a cost of $150,000 even with bulk domain purchasing discounts. Over 3,500 of the domains were purchased on May 5th alone.

The behavior and domains exhibit key characteristics of an automated domain generation algorithm capability:

  • The domains are registered every 7 seconds (as seen by the timestamps)

  • The domains are a hash of letters with mostly a ".pw" TLD

The threat actor then shifted tactics and began the use of a proxy/VPN on May 13th to register 1,280 domains. The unredacted name, physical address and telephone number of the actor is in Turkey along with the location of the proxy/VPN address.

There is obviously more discovery to be done but this illustrates the power of a single pivot that delivers a wealth of information and may be the early indication of an emerging campaign.

Read More →
Threat Hunting