DNSpionage Drops New Karkoff Malware, Cherry-Picks Its Victims

guest · Apr 23, 2019

DNSpionage Drops New Karkoff Malware, Cherry-Picks Its Victims
April 23, 2019
https://www.bleepingcomputer.com/ne...new-karkoff-malware-cherry-picks-its-victims/

The DNSpionage malware campaign has added a new reconnaissance stage showing that the attackers have become more picky with their targets, as well as a new .NET-based malware dubbed Karkoff and designed to allow them to execute code remotely on compromised hosts.

DNSpionage's new victim survey phase will also allow it to avoid being analyzed by researchers and dropping its malware payloads on sandboxes designed for malware analysis, as detailed by the Warren Mercer and Paul Rascagneres Cisco Talos security researchers.
New malicious tools designed to improve attack efficiency
Since the initial report, the hackers behind the DNSpionage campaign have improved their attack methods and expanded their malicious toolset, as learned by Cisco Talos during February when they spotted new and updated malware being dropped during the attacks.

The attackers also improved the malware's capability of hiding its activity by splitting API calls effectively breaking Yara rules designed to detect malicious activity based on specific strings.
Click to expand...

Cisco Talos: DNSpionage brings out the Karkoff

Log in or Sign up

DNSpionage Drops New Karkoff Malware, Cherry-Picks Its Victims

guest Guest

Log in or Sign up

DNSpionage Drops New Karkoff Malware, Cherry-Picks Its Victims

guest Guest

Useful Searches