Most domains created by Revolver Rabbit contained at least one dictionary word and a five-digit number separated from each other by a dash, a report from Infoblox showed. While Revolver Rabbit’s .BOND domains were most evident, the threat operation was noted by Infoblox Vice President of Threat Intelligence Renee Burton to have already established over 700,000 domains across various TLDs, “Connecting the Revolver Rabbit RDGA to an established malware after months of tracking highlights the importance of understanding RDGAs as a technique within the threat actor’s toolbox,”

Source: SC Magazine