cyber.hendryadrian.com
Security Insights · silentpush.com

Silent Push Explains How Its Context Graph Flags Staged Adversary Infrastructure

· Original article ↗

Summary

Silent Push says its Context Graph identified a Salt Typhoon-related infrastructure cluster in May 2025, before public disclosure in October. The article describes its DNS and infrastructure signals, IOFA, and integrations for earlier blocking and investigation.

Key points

  • Silent Push says its proprietary Passive-Aggressive DNS (PADNS) re-resolves hostnames daily and combines DNS, WHOIS, host scans, certificates, honeypot interactions and ASN data to identify infrastructure it considers potentially adversary-controlled.
  • The company says it identified the same Salt Typhoon-related infrastructure cluster in May 2025, before public findings in October; this is a vendor-reported claim, not independent confirmation in the article.
  • Silent Push describes Indicators of Future Attack (IOFA) as complementary to IOCs: IOFA flags infrastructure being staged, while IOCs record infrastructure already used.
  • The article says Context Graph data can feed SIEM, SOAR and endpoint detection lists, enrich alerts, and support automated response workflows.
  • Silent Push says 10,000 external IP addresses and domains observed in enterprise telemetry were enough to seed its infrastructure-monitoring loop.
  • The company presents deterministic DNS, certificate, WHOIS and behavioral data as a basis for AI-assisted infrastructure pivots and investigation.

Article Details

Topic
Pre-weaponization detection of adversary infrastructure using Indicators of Future Attack (IOFA)

MITRE ATT&CK

T1583.001 · DomainsThe article describes adversaries registering domains in advance as part of staging infrastructure.T1583.004 · ServerThe article describes adversaries configuring servers and supporting infrastructure before launching attacks.

Threat Actors

Salt TyphoonThe article says Silent Push identified in May the same infrastructure cluster associated with Salt Typhoon that DarkTrace publicly reported in October 2025, with activity noted back to July.

Vendors

Silent PushSilent Push says traditional threat intelligence mostly sees attacks after they happen, while the Context Graph is designed to surface adversary infrastructure during the preparation phase before weaponization.

Products

Context GraphSilent Push says traditional threat intelligence mostly sees attacks after they happen, while the Context Graph is designed to surface adversary infrastructure during the preparation phase before weaponization.Threat Check APIOur Threat Check API provides high-throughput true/false verdicts on any indicator, short-circuiting enrichment queues and accelerating triage without adding manual steps.

Related Articles