Saturday, November 16, 2024
HomeComputer SecurityHackers Behind DNSpionage Created a New Remote Admin Tool for C2 Server...

Hackers Behind DNSpionage Created a New Remote Admin Tool for C2 Server Communication Over HTTP and DNS

Published on

Threat actors behind the new malware campaign DNSpionage created a new remote administrative tool that supports HTTP and DNS communication with C&C Server that operates by attackers.

Based on a recent incident, the DNSpionage campaign which is developed and operates by APT 34 hacking group to perform MITM Attack to steal the authentication details through Hijacking the DNS.

Malware authors behind this campaign continuously employed new tactics to evade the detection and increase the success ratio of the infection and compromise the targets.

- Advertisement - SIEM as a Service

At this new DNSpionage campaign, Threat actors developed a new malware called “Karkoff.

Infection Process and Communication

The initial stage of this new wave, attackers used an Excel document with a macro and they deploy newly developed remote Admin Tool that supports HTTP and DNS communication to the C2 server.

Threat actor added a reconnaissance phase to ensure that the payload is being dropped on specific targets.

A future that added within this malware search for two Anti-Virus software
Avira and Avast and check whether any of these security products are installed on the system and terminate its process if the result will be positive.

According to Talos Report, Te malware author left two different internal names in plain text: “DropperBackdoor” and “Karkoff”, the malware is lightweight compared to other malware due to its small size and allows remote code execution from the C2 server. 

During the C2 server communication phase, the malware uses either domain or IP address and also it supports both HTTP and HTTPS communications.

In order to obfuscate the C2 server communication, malware using base64 encoding, and also using XOR function for other obfuscation processes.

Based on the timeline of observed attacks and overlaps in IP usage during the DNSpionage campaign, Researchers believe that the same actor uses the Karkoff and DNSpionage samples.

“Also there is similar evidence indicates that DNSpionage may be a part of OilRig and we identified the C2 panel as “Scarecrow,” but we did not identify references to this panel in the leak. The victims in this screenshot are mainly from Lebanon, which is one of the areas targeted by DNSpionage and Karkoff” Talos Said.”

“The discovery of Karkoff also shows the actor is pivoting and is increasingly attempting to avoid detection while remaining very focused on the Middle Eastern region.”

Also, the Department of Homeland Security (DHS) issued a DNS hijacking campaign alert requiring all U.S. agencies to check if their .gov or agency-managed domains are resolving to the right IP addresses.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Indicator of Compromise

DNSpionage XLS document

2fa19292f353b4078a9bf398f8837d991e383c99e147727eaa6a03ce0259b3c5 (SHA256)

DNSpionage sample

e398dac59f604d42362ffe8a2947d4351a652516ebfb25ddf0838dd2c8523be8 (SHA256)

Karkoff samples

5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c
6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11
b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04
cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitrary Code Remotely

A critical security flaw has been uncovered in certain TP-Link routers, potentially allowing malicious...

Chinese SilkSpecter Hackers Attacking Black Friday Shoppers

SilkSpecter, a Chinese financially motivated threat actor, launched a sophisticated phishing campaign targeting e-commerce...

Cybercriminals Launch SEO Poisoning Attack to Lure Shoppers to Fake Online Stores

The research revealed how threat actors exploit SEO poisoning to redirect unsuspecting users to...

Black Basta Ransomware Leveraging Social Engineering For Malware Deployment

Black Basta, a prominent ransomware group, has rapidly gained notoriety since its emergence in...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Cybercriminals Launch SEO Poisoning Attack to Lure Shoppers to Fake Online Stores

The research revealed how threat actors exploit SEO poisoning to redirect unsuspecting users to...

China-Nexus Actors Hijack Websites to Deliver Cobalt Strike malware

A Chinese state-sponsored threat group, identified as TAG-112, has been discovered hijacking Tibetan community...

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases...