Dancho Danchev’s Blog – Mind Streams of Information Security Knowledge: Exposing an Indian Police Spyware Cyber Operation

This analysis is based on this Wired.com story.

Sample Gmail accounts known to have been involved in the campaign include:
jagdish.meshraam@gmail.com
drsnehapatil64@gmail.com
sinhamuskaan04@gmail.com
jennifergonzales789@gmail.com
payalshastri79@gmail.com

Sample malicious domains known to have been involved in the campaign:
researchplanet.zapto.org
socialstatistics.zapto.org
duniaenewsportal.ddns.net

Sample domain registrant email address accounts known to have been involved in the campaign include:
harpreet.singh1984@yahoo.com
marlenecharlton@outlook.com
abadaba@eml.cc
REUBEN123@RISEUP.NET

Related malicious domains known to have been involved in the campaign include:
hxxp://greenpeacesite.com
hxxp://new-agency.us
hxxp://chivalkarstone.com
hxxp://newmms.ru
hxxp://gayakwaad.com
hxxp://bbcworld-news.net
hxxp://newsinbbc.com