New Pingback Malware Using ICMP Tunneling to Evade C&C Detection

guest · May 4, 2021

New Pingback Malware Using ICMP Tunneling to Evade C&C Detection
May 4, 2021
https://thehackernews.com/2021/05/new-pingback-malware-using-icmp.html

Researchers on Tuesday disclosed a novel malware that uses a variety of tricks to stay under the radar and evade detection, while stealthily capable of executing arbitrary commands on infected systems.

Called 'Pingback,' the Windows malware leverages Internet Control Message Protocol (ICMP) tunneling for covert bot communications, allowing the adversary to utilize ICMP packets to piggyback attack code, according to an analysis published today by Trustwave.
Click to expand...

Specifically, Pingback takes advantage of an Echo request (ICMP message type 8), with the message sequence numbers 1234, 1235, and 1236 denoting the type of information contained in the packet — 1234 being a command or data, and 1235 and 1236 being the acknowledgment for receipt of data on the other end.

"ICMP tunneling is not new, but this particular sample piqued our interest as a real-world example of malware using this technique to evade detection," the researchers said.
Click to expand...

Log in or Sign up

New Pingback Malware Using ICMP Tunneling to Evade C&C Detection

guest Guest

Log in or Sign up

New Pingback Malware Using ICMP Tunneling to Evade C&C Detection

guest Guest

Useful Searches