Security Affairs

AUGUST 4, 2024

A China-linked APT, tracked as StormBamboo, compromised an internet service provider (ISP) to poison software update mechanisms with malware. The threat actors targeted insecure software update mechanisms to install malware on macOS and Windows victim machines. The company linked the attacks to StormBamboo APT group.

Malware 144

Malware DNS Firewall Software 144

Bleeping Computer

APRIL 23, 2023

A new enterprise-targeting malware toolkit called 'Decoy Dog' has been discovered after inspecting anomalous DNS traffic that is distinctive from regular internet activity. [.]

DNS 114

DNS Malware Internet Internet 114

Bleeping Computer

JUNE 14, 2023

The Chinese threat group 'ChamelGang' infects Linux devices with a previously unknown implant named 'ChamelDoH,' allowing DNS-over-HTTPS communications with attackers' servers. [.]

DNS 140

DNS Malware 140

eSecurity Planet

NOVEMBER 10, 2023

DNS security protects the domain name system (DNS) from attackers seeking to reroute traffic to malicious sites. Since a majority of business IT traffic now accesses or passes through the internet, DNS plays an increasingly important — and vulnerable — role. in the DNS cache for more efficient delivery of information to users.

DNS 109

DNS DDOS Encryption Authentication 109

CSO Magazine

MARCH 14, 2023

During every quarter last year, between 10% and 16% of organizations had DNS traffic originating on their networks towards command-and-control (C2) servers associated with known botnets and various other malware threats, according to a report from cloud and content delivery network provider Akamai.

DNS 128

DNS Malware Ransomware 128

Security Boulevard

AUGUST 6, 2024

Threat Intelligence Report Date: August 6, 2024 Prepared by: David Brunsdon, Threat Intelligence - Security Engineer, HYAS Dynamic DNS (DDNS) is a service that automatically updates the Domain Name System (DNS) in real-time to reflect changes in the IP addresses of a domain.

DNS 69

DNS Malware Social Engineering Engineering 69

Penetration Testing

OCTOBER 7, 2024

Cyber attackers are increasingly exploiting DNS tunneling as a covert means to conduct malicious activities, evade detection, and exfiltrate data.

DNS 79

DNS Cyber Attacks Cybersecurity Malware 79

The Hacker News

JANUARY 20, 2023

Threat actors associated with the Roaming Mantis attack campaign have been observed delivering an updated variant of their patent mobile malware known as Wroba to infiltrate Wi-Fi routers and undertake Domain Name System (DNS) hijacking.

DNS 114

DNS Mobile Malware 114

Security Boulevard

JUNE 9, 2022

Active since 2017, Lyceum group is a state-sponsored Iranian APT group that is known for targeting Middle Eastern organizations in the energy and telecommunication sectors and mostly relying on.NET based malwares. The threat actor then leverages the AutoClose() function to drop the DNS backdoor onto the system. Lyceum.NET DNS backdoor.

DNS 98

DNS Energy and Utilities Malware Telecommunications 98

Dark Reading

JANUARY 31, 2023

Malware eventually has to exfiltrate the data it accessed. By watching DNS traffic for suspicious activity, organizations can halt the damage.

DNS 85

DNS Malware 85

Bleeping Computer

JANUARY 19, 2023

Starting in September 2022, the 'Roaming Mantis' credential theft and malware distribution campaign was observed using a new version of the Wroba.o/XLoader XLoader Android malware that incorporates a function for detecting specific WiFi routers and changing their DNS. [.]

DNS 88

DNS Malware Hacking Mobile 88

Security Affairs

JUNE 11, 2022

Iran-linked Lyceum APT group uses a new.NET-based DNS backdoor to target organizations in the energy and telecommunication sectors. The Iran-linked Lyceum APT group, aka Hexane or Spilrin, used a new.NET-based DNS backdoor in a campaign aimed at companies in the energy and telecommunication sectors, ZScaler researchers warn.

DNS 145

DNS Telecommunications Malware Phishing 145

Dark Reading

MARCH 14, 2023

An analysis of trillions of DNS requests shows a shocking amount of malicious traffic inside enterprise networks, with threats using DNS as a sort of malicious Autobahn.

DNS 78

DNS Malware 78

Bleeping Computer

JANUARY 22, 2024

Hackers are using a stealthy method to deliver to macOS users information-stealing malware through DNS records that hide malicious scripts. [.]

DNS 106

DNS Malware Cryptocurrency 106

The Hacker News

JUNE 16, 2023

The malware, dubbed ChamelDoH by Stairwell, is a C++-based tool for communicating via DNS-over-HTTPS (DoH) tunneling. The threat actor known as ChamelGang has been observed using a previously undocumented implant to backdoor Linux systems, marking a new expansion of the threat actor's capabilities.

DNS 145

DNS Technology Malware Cybersecurity 145

Security Boulevard

JULY 9, 2024

Operational resiliency necessitates intelligence, visibility, and confidence: the three foundational pillars of protective DNS (PDNS). This makes malware command-and-control, phishing attacks, DNS tunneling and a number of other attacks significantly less effective. But Wait, What Is Protective DNS?

DNS 64

DNS Cyber threats Cyber Attacks Phishing 64

Security Affairs

MARCH 17, 2022

Researchers uncovered a new Linux botnet, tracked as B1txor20, that exploits the Log4J vulnerability and DNS tunnel. The malware was first spotted on February 9, 2022, when 360Netlab’s honeypot system captured an unknown ELF file that was spreading by exploiting the Log4J vulnerability. ” continues the analysis.

DNS 144

DNS Malware Technology Encryption 144

Schneier on Security

JUNE 30, 2022

Wired is reporting on a new remote-access Trojan that is able to infect at least eighty different targets: So far, researchers from Lumen Technologies’ Black Lotus Labs say they’ve identified at least 80 targets infected by the stealthy malware, including routers made by Cisco, Netgear, Asus, and DrayTek.

Malware 218

Malware DNS Architecture Hacking 218

The Hacker News

JUNE 13, 2022

The new malware is a.NET based DNS Backdoor which is a customized version of the open source tool 'DIG.net,'" Zscaler ThreatLabz researchers Niraj Shivtarkar and Avinash Kumar said in a report published last week. "

DNS 105

DNS Malware 105

eSecurity Planet

MAY 3, 2022

Security researchers have uncovered a critical vulnerability that could lead to DNS spoofing attacks in two popular C standard libraries that provide functions for common DNS operations. Understanding DNS Spoofing Attacks. For example, when you enter [link] the browser queries a DNS service to reach the matching servers.

DNS 131

DNS Risk Firmware IoT 131

Security Affairs

MAY 1, 2024

A new malware named Cuttlefish targets enterprise-grade and small office/home office (SOHO) routers to harvest public cloud authentication data. The malware creates a proxy or VPN tunnel on the compromised router to exfiltrate data, and then uses stolen credentials to access targeted resources.

Malware 130

Malware DNS Authentication Telecommunications 130

Threatpost

DECEMBER 2, 2020

Peter Lowe with DNSFilter discusses the science behind domain name system (DNS) filtering and how this method is effective in blocking out phishing and malware.

DNS 94

DNS Phishing Malware Internet 94

SecureList

JANUARY 19, 2023

Kaspersky has been investigating the actor’s activity throughout 2022, and we observed a DNS changer function used for getting into Wi-Fi routers and undertaking DNS hijacking. This was newly implemented in the known Android malware Wroba.o/Agent.eq Moqhao, XLoader), which was the main malware used in this campaign.

DNS 125

DNS Mobile Malware Accountability 125

Security Affairs

APRIL 24, 2024

A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute backdoors and cryptocurrency miners. Avast researchers discovered and analyzed a malware campaign that exploited the update mechanism of the eScan antivirus to distribute backdoors and crypto miners.

Antivirus 131

Antivirus Malware DNS Cryptocurrency 131

Bleeping Computer

JULY 25, 2023

New details have emerged about Decoy Dog, a largely undetected sophisticated toolkit likely used for at least a year in cyber intelligence operations, relying on the domain name system (DNS) for command and control activity. [.]

DNS 81

DNS Malware 81

Heimadal Security

SEPTEMBER 14, 2023

As malware and attack techniques continue to evolve in sophistication, DNS IoCs help threat hunting teams to prevent ransomware attacks. Prioritizing threat hunting to prevent and mitigate advanced threats is critical to safeguarding an organization`s data and assets.

DNS 76

DNS Ransomware Malware Cybersecurity 76

Security Affairs

APRIL 18, 2019

Iran-linked APT group OilRig is heavily leveraging on DNS tunneling for its cyber espionage campaigns, Palo Alto Networks reveals. Security researchers at Palo Alto Networks reported that Iran-linked APT group OilRig is heavily leveraging on DNS tunneling for its cyber espionage campaigns, Palo Alto Networks reveals.

DNS 102

DNS Malware Advertising Hacking 102

SC Magazine

MARCH 4, 2021

A PDNS service uses existing DNS protocols and architecture to analyze DNS queries and mitigate threats. According to NSA and CISA, the service provides defenses in various points of the network exploitation lifecycle, addressing phishing, malware distribution, command and control, domain generation algorithms, and content filtering.

DNS 131

DNS Architecture Firewall Malware 131

Security Boulevard

MAY 20, 2022

What Is DNS Spoofing and How Is It Prevented? What Is the DNS and DNS Server? . To fully understand DNS spoofing, it’s important to understand DNS and DNS servers. The DNS “domain name system” is then what translates the domain name into the right IP address. What Is DNS Spoofing? .

DNS 98

DNS Cyber Attacks Encryption Risk 98

Krebs on Security

JULY 31, 2024

Your Web browser knows how to find a site like example.com thanks to the global Domain Name System (DNS), which serves as a kind of phone book for the Internet by translating human-friendly website names (example.com) into numeric Internet addresses. And the bulk of these are at a handful of DNS providers.”

DNS 272

DNS Internet Internet Phishing 272

Cisco Security

MARCH 11, 2021

After examining topics such as the MITRE ATT&CK framework , LOLBins , and others, this release will look at DNS traffic to malicious sites. We’ll also look at malicious DNS activity—the number of queries malicious sites receive. Organizations and malicious DNS activity. 48 percent found information-stealing malware activity.

DNS 144

DNS Phishing Ransomware Internet 144

Malwarebytes

JUNE 1, 2022

That’s where DNS filtering comes in. But first, DNS in a nutshell. So normally, every time your customer types in your web address, their computer makes a request to a DNS server. The DNS server, in turn, tells the computer where to go. But which web-based cyberthreats in particular does DNS filtering stop, you ask?

DNS 84

DNS DDOS Phishing Spyware 84

Security Boulevard

OCTOBER 2, 2023

This blog examines the escalating phishing landscape, shortcomings of common anti-phishing approaches, and why implementing a Protective DNS service as part of a layered defense provides the most effective solution. This is where Protective DNS comes in. Phishing attacks are becoming more automated.

DNS 64

DNS Phishing Social Engineering Engineering 64

Security Affairs

DECEMBER 3, 2023

Threat actors are using the Agent Raccoon malware in attacks against organizations in the Middle East, Africa and the U.S. The malware was used in attacks against multiple industries, including education, real estate, retail, non-profit organizations, telecom companies, and governments. telemetry. .

Malware 143

Malware DNS Retail Education 143

Security Boulevard

JUNE 28, 2024

For users of HYAS Protect , HYAS disables DNS resolutions that would lead to these redirects and other potential compromises. DNS is the ideal place to block potentially malicious CDNs, like we have here. More from HYAS Labs Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC. Want more threat intel on a weekly basis?

DNS 52

DNS Malware Cyber Attacks Mobile 52

Security Boulevard

APRIL 14, 2022

The apps stole user credentials and forwarded the messages to the malware operators. The post What is DNS Spoofing and Cache Poisoning? The post What is DNS Spoofing and Cache Poisoning? Bad actors love social engineering, and even distribute the spoofed websites via Facebook ads. appeared first on EasyDMARC.

DNS 72

DNS Social Engineering Cybercrime Banking 72

Krebs on Security

JUNE 21, 2023

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. This story explores the history and identity behind Cryptor[.]biz WHO RUNS CRYPTOR[.]BIZ?

Malware 237

Malware Antivirus Cybercrime Hacking 237