Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/3/2017
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Attackers Employ Sneaky New Method to Control Trojans

A new malware sample shows threat actors have begun using DNS TXT record and queries for C2 communications, Cisco Talos says,

Security researchers at Cisco’s Talos intelligence and research group have discovered what they describe as an extremely evasive and uncommon way for threat actors to command and to communicate with a Remote Access Trojan (RAT) on an infected system.

The multi-stage method involves the use of the Domain Name System (DNS) in a manner that makes bidirectional C2 communication between an infected host and a malicious server almost invisible - even to organizations that have implemented controls for restricting outbound DNS.

Talos security researchers discovered the new threat while studying a malware sample that had been uploaded to a public sandbox designed for malware analysis. Their analysis revealed the malware was designed to infect targeted systems via the use of phishing emails containing a malicious Word document.

The Word document was designed to appear associated with an email service secured by McAfee, and urged recipients to enable macros. Executing the macro initiated a multi-stage infection process involving the use of Powershell. Like many other emerging malware products, this one too, was designed to execute in memory and without requiring malicious code to be written to the file system of the infected system.

What made the malware different, however, was its use of DNS TXT record queries and responses for creating a command and control channel.

"DNS TXT records are records that are normally used by DNS to transfer text-based information," says Edmund Brumaghin, a Talos threat researcher. Such records are commonly used for email authentication functions such as DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF), and Domain Message Authentication Reporting & Conformance (DMARC).

"Using this mechanism for C2 allows the malware to bypass many of the security controls normally deployed to protect enterprise networks," he says.

Clients infected with the malware will still be able to reach their C2 infrastructure using the normal DNS lookup process, even in situations where an organization might have blocked outbound DNS for all but approved DNS servers.

"Many organizations inspect the contents of Web traffic, email, etc., but do not actively inspect the content of DNS requests," Brumaghin says.

Since the infection process itself is initiated through a macro-based Powershell command, one way for an organization to mitigate this particular threat is to block the execution of macros. The DNS requests and responses associated with the C2 traffic are also different from normal DNS communication. So DNS inspection can allow for quick detection and response when a host is infected, he says.

The bigger takeaway for organizations is that adversaries are constantly looking for new ways around whatever security controls organizations might put in front of them, Brumaghin says.  

In this case, instead of using the usual protocols for establishing bi-directional command and communications traffic, the malware authors devised a completely new, multi-stage infrastructure that leveraged DNS through TXT records. "They are relying on the fact that many organizations invest in inspection of web, email, and other traffic on their networks, but may not be inspecting DNS with the same level of scrutiny."

Cisco Talos has posted an alert with full technical details on the threat and Indicators of Compromise (IOC) that can be used to identify the attack.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15296
PUBLISHED: 2019-08-21
An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is ne...
CVE-2019-15292
PUBLISHED: 2019-08-21
An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.
CVE-2019-15293
PUBLISHED: 2019-08-21
An issue was discovered in ACDSee Photo Studio Standard 22.1 Build 1159. There is a User Mode Write AV starting at IDE_ACDStd!IEP_ShowPlugInDialog+0x000000000023d060.
CVE-2019-5034
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vuln...
CVE-2019-5035
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker c...