DNSpionage brings out the Karkoff
Summary: Cisco Talos reported that the DNSpionage actors, first disclosed in November 2018 and flagged in a January DHS alert, added a reconnaissance phase in February 2019 that fingerprints victims via WMI process listing, username, computer name and the NetWkstaGetInfo() API before dropping payloads. In April 2019 Talos found a new .NET malware it named Karkoff, a Windows service called "MSExchangeClient" that supports HTTP and HTTPS command and control, base64-encodes and XORs traffic with key 70, and logs executed commands to C:\Windows\Temp\MSEx_log.txt.
Why it matters: Talos tied Karkoff to DNSpionage with high confidence through shared C2 infrastructure, including the domain rimrun[.]com, meaning one actor is now running both a DNS-tunneling implant and a lightweight remote-code-execution backdoor against targets concentrated in the Middle East. The Karkoff log file at C:\Windows\Temp\MSEx_log.txt records every command with a timestamp, so a compromised organization can reconstruct exactly what the attacker ran.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026