Threat Actor Uses DNS Redirects, DNSpionage RAT to Attack Government Targets

guest · Nov 28, 2018

Threat Actor Uses DNS Redirects, DNSpionage RAT to Attack Government Targets
Malware used in the attacks communicates via DNS tunneling
November 27, 2018
https://news.softpedia.com/news/thr...rat-to-attack-government-targets-524015.shtml

Cisco Talos discovered a new malware campaign targeting a commercial Lebanese airline company, as well as United Arab Emirates (UAE) and Lebanon government domains. [...] Cisco Talos' findings [...]

The actor was observed while using maliciously crafted Word and Excel documents powered by macros which would compromise targets visiting two fake job postings websites controlled by the attacker.

The documents used to infect targets drop a new remote administration tool which Cisco Talos named DNSpionage because of its capability of communicating with its masters using a DNS tunneling communication channel.
The threat group used Let's Encrypt certificates to give legitimacy to their DNS redirect attacks
[...] the security impact can be very high considering that the threat group could have intercepted all the traffic going to these domains' servers, from emails and credentials to multi-factor authentication (MFA) codes.
Click to expand...

Log in or Sign up

Threat Actor Uses DNS Redirects, DNSpionage RAT to Attack Government Targets

guest Guest

Log in or Sign up

Threat Actor Uses DNS Redirects, DNSpionage RAT to Attack Government Targets

guest Guest

Useful Searches