Spoofed SEC Emails Distribute Evolved DNSMessenger
Summary: Cisco Talos reports a new DNSMessenger campaign that begins with spear phishing emails spoofed to appear as if sent by the SEC's EDGAR filing system, carrying malicious Microsoft Word attachments that use Dynamic Data Exchange (DDE) rather than macros or OLE objects to execute code. The DDEAUTO field pulled PowerShell code from a seemingly compromised Louisiana state government website, and the malware achieved persistence via registry keys, an Alternate Data Stream at %PROGRAMDATA%\Windows:kernel32.dll, a scheduled task named "IE", and WMI event consumer and filter named "kernel32_consumer" and "kernel32_filter", with later-stage code and C2 delivered over DNS TXT records.
Why it matters: The attackers hid their command channel inside DNS queries and responses, so the C2 traffic looks like ordinary name resolution rather than a connection your perimeter controls are watching for. Talos says it could not retrieve the next-stage payload from the C2 servers, indicating the actor is restricting communications to the specific targeted organizations to evade security researchers.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026