Friday, June 14, 2024

Enterprise-Attacking Malware Toolkit Analyzing 70 Billion DNS Queries Daily

The ‘Decoy Dog’ malware toolkit, aimed at enterprises, was uncovered recently by the security analysts at Infoblox by analyzing 70 billion DNS records and traffic that differs from typical online behavior.

Decoy Dog was discovered in early April 2023, and by using domain aging and DNS query dribbling tactics, the Decoy Dog malware assists threat actors in avoiding traditional detection methods. 

This strategy enables them to build a positive reputation with security vendors before transitioning to supporting cybercrime activities.

Decoy Dog has an exceptionally rare and distinct DNS fingerprint compared to the 370 million active domains on the internet, facilitating its identification and tracking.

Technical Analysis

Numerous C2 domains related to the operation were identified after the inquiry into Decoy Dog’s infrastructure. The majority of these server communications emerged from Russian-based hosts.

Apart from this, a RAT utilized by the Decoy Dog toolkit has been identified while analyzing the DNS tunnels on these domains, and the RAT is dubbed “Pupy RAT.”

State-sponsored threat actors favor Pupy RAT due to its modularity, open-source nature, and stealth capabilities (fileless execution), which enable them to blend in with other users and support encrypted C2 communications.

Time Line

Here below, we have mentioned the domains that were flagged for suspicious activity in early April 2023:-

  • cbox4[.]ignorelist[.]com
  • claudfront[.]net
  • hsdps[.]cc
  • ads-tm-glb[.]click
  • atlas-upd[.]com
  • allowlisted[.]net

In all major operating systems, the Pupy RAT project supports the payloads, and here below, we have mentioned the OS platforms:-

  • Windows
  • macOS
  • Linux
  • Android

Here below, we have mentioned the capabilities of Pupy RAT:-

  • Enables execution of commands remotely
  • Elevate privileges
  • Steal credentials
  • Spread laterally through a network

Less experienced actors do not commonly use Pupy RAT since setting up the appropriate DNS server configuration for C2 communications is complicated and unsuitable for less experienced actors.

The DNS signature spanning multiple parts provided a high level of certainty that the correlated domains were part of the Decoy Dog toolkit, which distinctly utilizes Pupy RAT on non-consumer devices, such as those found in large enterprises or organizations.

Characteristics of Decoy Dog’s Toolkit

Here below, we have mentioned the characteristics of Decoy Dog’s toolkit:-

  • Pupy RAT
  • Unique DNS Signature
  • DNS Beaconing
  • Outlier Behavior
  • Shared Hosting
  • Registration Similarities
  • Enterprise Focus

Analysts also detected a unique DNS beaconing pattern on all Decoy Dog domains that conforms to the infrequent but regular generation of DNS requests at set intervals.

DNS Graph

Decoy Dog has operated secretly since April 2022, unnoticed for over a year despite analytics detecting unusual activity in its toolkit domains.

Detecting anomalous activity in the massiveness of the internet is made possible by using large-scale data analytics, and the discovery of Decoy Dog is a perfect example.

Building Your Malware Defense Strategy – Download Free E-Book


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles