Glimpse malware uses alternative DNS to evade detection

guest · Nov 11, 2019

Glimpse malware uses alternative DNS to evade detection
APT34 hacker group behind PowerShell-based malicious code
https://www.scmagazineuk.com/glimpse-malware-uses-alternative-dns-evade-detection/article/1665336

Security researchers have detailed how the Glimpse malware uses a text mode as an alternative DNS resource record type.

According to a blog post by security researchers Jon Perez and Jonathan Lepore at IronNet, the malware is written in PowerShell and associated with APT34. It is executed by Visual Basic script, yet how the script is initiated remains unclear, researchers said.
They added that the malware is similar to the PoisonFrog malware. Both use "A" resource records to communicate with their controller.

"Glimpse does not take advantage of the recursion typically observed in DNS communications (ie, the infected victim sends DNS queries directly to the controller). Communicating directly to the controller, while operationally viable, may not be successful in environments that limit the use of external DNS servers," said researchers.
The researchers said that the differences between PoisonFrog and Glimpse" highlight the ease at which adversaries can modify their tools to meet their end objectives".
Click to expand...

IronNet: A Glimpse into Glimpse

Glimpse added the ability to use an alternate DNS resource record type (TXT) as opposed to solely relying on A resource records for DNS queries. Using TXT resource records enabled the actors to provide tasking in fewer transactions due to the amount of data that can be transmitted in a TXT response.
Click to expand...

Log in or Sign up

Glimpse malware uses alternative DNS to evade detection

guest Guest

Log in or Sign up

Glimpse malware uses alternative DNS to evade detection

guest Guest

Useful Searches