MoqHao Part 1: Identifying Phishing Infrastructure

Cyber Reconnaissance with Team Cymru's Pure Signal™ Platform

In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and Taiwan:

Figure 1 – Seed Twitter Post

PASSIVE DNS DATA

Using Team Cymru’s Pure Signal Platform, we performed a wildcard search for domains using the pattern of ‘t.aeo*.com’. This search identified all of the domains and the hosting IP addresses…