Aside from leveraging dynamic IP addresses, Fox Kitten also sought to conceal its attack infrastructure through broad Autonomous System deployment and spurious certificate names, according to the Censys report, which was based on data from the joint FBI, Cybersecurity and Infrastructure Security Agency, and Department of Defense Cyber Crime Center warning. Further analysis revealed a pair of domain IOCs not previously detailed by the joint cybersecurity advisory; similarities in geolocations and Autonomous System numbers among the hosts, and over 38,000 similar hosts suspected to be malicious.

Source: SC Magazine