Necurs Botnet Evolves to Hide in the Shadows, with New Payloads

guest · Mar 1, 2019

Necurs Botnet Evolves to Hide in the Shadows, with New Payloads
Using an on-again, off-again strategy of C2 communication helps it hide from researchers
March 1, 2019
https://threatpost.com/necurs-botnet-hide-payloads/142334/

According to research from Black Lotus Lab [...] Necurs last year began implementing regular, sustained downtime segments for its command-and-control (C2) infrastructure [...]
“At times, they’ve been known to be inactive for weeks,” the firm said, in a blog post on Thursday. “Most recently, the C2s have gone offline for most of the last four months, coming online for short periods of time about once a week.”

“Most recently, Necurs has been seen pushing out infostealers and RATs, [...] These new capabilities represent a significant increase in Necurs’ ability to perpetrate spear-phishing, financial crimes and espionage.”

CenturyLink has been actively trying to sinkhole sections of Necurs, but the blog noted the difficulties in making that happen, thanks to the fact that Necurs uses a domain generation algorithm (DGA) to obfuscate its operations and avoid takedown.
Click to expand...

Log in or Sign up

Necurs Botnet Evolves to Hide in the Shadows, with New Payloads

guest Guest

Log in or Sign up

Necurs Botnet Evolves to Hide in the Shadows, with New Payloads

guest Guest

Useful Searches