Thursday, October 3, 2024
HomeCyber AttackEnterprise-Attacking Malware Toolkit Analyzing 70 Billion DNS Queries Daily

Enterprise-Attacking Malware Toolkit Analyzing 70 Billion DNS Queries Daily

Published on

The ‘Decoy Dog’ malware toolkit, aimed at enterprises, was uncovered recently by the security analysts at Infoblox by analyzing 70 billion DNS records and traffic that differs from typical online behavior.

Decoy Dog was discovered in early April 2023, and by using domain aging and DNS query dribbling tactics, the Decoy Dog malware assists threat actors in avoiding traditional detection methods. 

This strategy enables them to build a positive reputation with security vendors before transitioning to supporting cybercrime activities.

- Advertisement - EHA

Decoy Dog has an exceptionally rare and distinct DNS fingerprint compared to the 370 million active domains on the internet, facilitating its identification and tracking.

Technical Analysis

Numerous C2 domains related to the operation were identified after the inquiry into Decoy Dog’s infrastructure. The majority of these server communications emerged from Russian-based hosts.

Apart from this, a RAT utilized by the Decoy Dog toolkit has been identified while analyzing the DNS tunnels on these domains, and the RAT is dubbed “Pupy RAT.”

State-sponsored threat actors favor Pupy RAT due to its modularity, open-source nature, and stealth capabilities (fileless execution), which enable them to blend in with other users and support encrypted C2 communications.

Time Line

Here below, we have mentioned the domains that were flagged for suspicious activity in early April 2023:-

  • cbox4[.]ignorelist[.]com
  • claudfront[.]net
  • hsdps[.]cc
  • ads-tm-glb[.]click
  • atlas-upd[.]com
  • allowlisted[.]net

In all major operating systems, the Pupy RAT project supports the payloads, and here below, we have mentioned the OS platforms:-

  • Windows
  • macOS
  • Linux
  • Android

Here below, we have mentioned the capabilities of Pupy RAT:-

  • Enables execution of commands remotely
  • Elevate privileges
  • Steal credentials
  • Spread laterally through a network

Less experienced actors do not commonly use Pupy RAT since setting up the appropriate DNS server configuration for C2 communications is complicated and unsuitable for less experienced actors.

The DNS signature spanning multiple parts provided a high level of certainty that the correlated domains were part of the Decoy Dog toolkit, which distinctly utilizes Pupy RAT on non-consumer devices, such as those found in large enterprises or organizations.

Characteristics of Decoy Dog’s Toolkit

Here below, we have mentioned the characteristics of Decoy Dog’s toolkit:-

  • Pupy RAT
  • Unique DNS Signature
  • DNS Beaconing
  • Outlier Behavior
  • Shared Hosting
  • Registration Similarities
  • Enterprise Focus

Analysts also detected a unique DNS beaconing pattern on all Decoy Dog domains that conforms to the infrequent but regular generation of DNS requests at set intervals.

DNS Graph

Decoy Dog has operated secretly since April 2022, unnoticed for over a year despite analytics detecting unusual activity in its toolkit domains.

Detecting anomalous activity in the massiveness of the internet is made possible by using large-scale data analytics, and the discovery of Decoy Dog is a perfect example.

Building Your Malware Defense Strategy – Download Free E-Book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Northern Ireland Police to Pay £750,000 Fine Following Data Breach

The Police Service of Northern Ireland (PSNI) has been ordered to pay a £750,000...

ANY.RUN Upgrades Threat Intelligence to Identify Emerging Threats

ANY.RUN announced an upgrade to its Threat Intelligence Portal, enhancing its capabilities to identify...

Cisco Nexus Vulnerability Let Hackers Execute Arbitrary Commands on Vulnerable Systems

A critical vulnerability has been discovered in Cisco's Nexus Dashboard Fabric Controller (NDFC), potentially...

Hackers Now Exploit Ivanti Endpoint Manager Vulnerability to Launch Cyber Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of a new...

Free Webinar

Decoding Compliance | What CISOs Need to Know

Non-compliance can result in substantial financial penalties, with average fines reaching up to $4.5 million for GDPR breaches alone.

Join us for an insightful panel discussion with Chandan Pani, CISO - LTIMindtree and Ashish Tandon, Founder & CEO – Indusface, as we explore the multifaceted role of compliance in securing modern enterprises.

Discussion points

The Role of Compliance
The Alphabet Soup of Compliance
Compliance
SaaS and Compliance
Indusface's Approach to Compliance

More like this

Northern Ireland Police to Pay £750,000 Fine Following Data Breach

The Police Service of Northern Ireland (PSNI) has been ordered to pay a £750,000...

Cisco Nexus Vulnerability Let Hackers Execute Arbitrary Commands on Vulnerable Systems

A critical vulnerability has been discovered in Cisco's Nexus Dashboard Fabric Controller (NDFC), potentially...

Hackers Now Exploit Ivanti Endpoint Manager Vulnerability to Launch Cyber Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of a new...