Nslookup

Reported Context (2)

The first one detects the client software used to connect to a Mesh Central Server, while the other one detects the use of Nslookup to enumerate mail servers: Huntress Details Intrusion Targeting Executive at Market Research Company
While doing some additional research I came across screenshots for Nslookup. I found a variety of screenshots making Nslookup requests to a range of different IPs with one similarity. Shodan Images Reveal Ransomware Activity on Exposed VNC Systems

Malware (1)

People (3)

Threat Actors (1)

MITRE ATT&CK (15)

Vendors (1)

Products (4)

Tools (8)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.