Fox IT

AUGUST 11, 2022

This Saitama implant uses DNS as its sole Command and Control channel and utilizes long sleep times and (sub)domain randomization to evade detection. In May 2022, security firm Malwarebytes published a two 1 -part 2 blog about a malware sample that utilizes DNS as its sole channel for C2 communication. Introduction.

DNS 66

DNS Engineering Malware Encryption 66

Security Affairs

JUNE 9, 2022

“Network telemetry can be used to detect anomalous DNS requests, and security tools such as antivirus and endpoint detection and response (EDR) should be statically linked to ensure they are not “infected” by userland rootkits.” Since the malware operates as a userland level rootkit, detecting an infection may be difficult.”

Malware 145

Malware DNS Antivirus Passwords 145

Security Affairs

MARCH 20, 2022

EU and US agencies warn that Russia could attack satellite communications networks Avoslocker ransomware gang targets US critical infrastructure Crooks claims to have stolen 4TB of data from TransUnion South Africa Exotic Lily initial access broker works with Conti gang Emsisoft releases free decryptor for the victims of the Diavol ransomware China-linked (..)

DNS 98

DNS Antivirus DDOS Hacking 98

Security Affairs

MAY 8, 2022

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.

IoT 98

IoT DNS Antivirus DDOS 98

Security Affairs

JULY 28, 2022

Researchers from threat intelligence firm RiskIQ, using passive DNS data related to Knotweed attacks, linked the C2 infrastructure used by the malware since February 2020 to DSIRF. One of the zero-day exploits used in Knotweed attacks was triggering the recently patched CVE-2022-22047 issue. or later to detect the related indicators.

Surveillance 100

Surveillance Malware Authentication Accountability 100

eSecurity Planet

MAY 2, 2024

50,000 DDoS attacks on public domain name service (DNS) resolvers. 553% increase in DNS Flood attacks from 1H 2020 to 2H 2023. DDoS attacks on single networks or websites render them unavailable, but DDoS attacks on DNS resolvers bring down all networks and websites using that DNS resource.

Cybersecurity 122

Cybersecurity DDOS Penetration Testing Ransomware 122

SecureWorld News

MARCH 29, 2024

In November 2022, cybercriminals somehow acquired the right to run ads on Google for the popular open-source graphics editor GIMP. A DNS firewall and a classic antivirus are somewhat underused yet effective security tools that will come in handy. Here's some evidence for those who consider the risk far-fetched.

Cybercrime 108

Cybercrime Advertising Engineering Antivirus 108

SecureList

OCTOBER 25, 2023

How it started In 2022, we came across two unexpected detections within the WININIT.EXE process of an older code which was earlier observed in Equation malware. During our analysis, the file was last updated on February 24, 2022, and the number of initial infections stood at 160,000 victims as of June 2022.

Malware 144

Malware DNS Encryption Cryptocurrency 144

SecureList

DECEMBER 1, 2023

Common TTPs in attacks on industrial organizations In 2022, we investigated a series of attacks against industrial organizations in Eastern Europe. Upon startup, this backdoor makes a type A DNS request for the <hex-encoded 20-byte string> u.fdmpkg[.]org org domain. Inject.aokvy.

Malware 138

Malware Ransomware Encryption Energy and Utilities 138

eSecurity Planet

MARCH 14, 2023

Endpoint security : protects endpoints with antivirus, endpoint detection and response (EDR) tools, etc. Other hackers might use a spoofed domain name system (DNS) or IP addresses to redirect users from legitimate connections (to websites, servers, etc.) endpoint security (antivirus, Endpoint Detection and Response, etc.),

Network Security 98

Network Security Firewall Penetration Testing Encryption 98

Security Boulevard

JUNE 15, 2023

As a result, this technique may bypass static antivirus signatures and complicate malware reverse engineering. This group of domains is noted to share the following attributes: Cloudflare nameservers and CDN fronting Nameservers: meadow, jimmy Registration details: Domains registered mid-late 2022 Registrar: Public Domain Registry (PDR Ltd.)

Cryptocurrency 52

Cryptocurrency Password Management Malware DNS 52

SecureList

APRIL 24, 2023

Introduction We introduced Tomiris to the world in September 2021, following our investigation of a DNS-hijack against a government organization in the Commonwealth of Independent States (CIS). JLORAT Our first sightings of this Rust malware date back to August 2022. su) that used to be part of a botnet (Andromeda) infrastructure.

Malware 135

Malware DNS Government Software 135

Malwarebytes

MAY 22, 2025

Lumma Stealer, also known as LummaC or LummaC2, first emerged in late 2022 and quickly established itself as one of the most prolific infostealers. Government agencies and researchers sometimes alter DNS addresses to lead the traffic to their own servers (called sinkholes). Be cautious with emails and downloads.

Cryptocurrency 102

Cryptocurrency Passwords Social Engineering Malware 102