New Mozart Malware Gets Commands, Hides Traffic Using DNS

guest · Feb 24, 2020

New Mozart Malware Gets Commands, Hides Traffic Using DNS
February 24, 2020
https://www.bleepingcomputer.com/ne...alware-gets-commands-hides-traffic-using-dns/

A new backdoor malware called Mozart is using the DNS protocol to communicate with remote attackers to evade detection by security software and intrusion detection systems.

Using HTTP/S communication to communicate, though, has its drawbacks as security software normally monitors this traffic for malicious activity. If detected, the security software will block the connection and the malware that performed the HTTP/S request.
Using DNS TXT records to issue commands
DNS is a name resolution protocol that is used to convert a hostname, such as www.example.com, to its IP addresses, 93.184.216.34, so that software can connect to the remote computer.
The Mozart attackers are using these DNS TXT records to store commands that are retrieved by the malware and executed on the infected computer.

At this time, it is not known what commands are being executed by Mozart as tests by myself and Kremez did not result in any responses to the DNS queries.
Click to expand...

Blocking this type of threat
It is important to note that malware using DNS to communicate is not unique to the Mozart backdoor.
In 2017, the Cisco Talos group discovered a malware called DNSMessenger that was also using TXT records for malicious communication.
Click to expand...

Log in or Sign up

New Mozart Malware Gets Commands, Hides Traffic Using DNS

guest Guest

Log in or Sign up

New Mozart Malware Gets Commands, Hides Traffic Using DNS

guest Guest

Useful Searches