One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks

Unit 42 describes an automated, GNN-driven approach to pivot from known indicators to discover extensive attacker infrastructure across three active campaigns: FIN7 spear-phishing distributing Aranuk/Carbanak, a global postal-service phishing network, and a web skimmer campaign exfiltrating payment data. The report maps thousands of domains and IPs, highlights shared hosting, certificates and phishing kits as pivot points, and publishes sample IOCs to enable proactive detection and blocking.