Forest Global Training Partners

Cyber Risks · Cisco Talos

Covert Channels and Poor Decisions: The Tale of DNSMessenger

Summary: Cisco Talos analyzed a malware sample, dubbed DNSMessenger, that uses DNS TXT record queries and responses to build a bidirectional command-and-control channel for administering a remote access trojan. The infection begins with a malicious Word document delivered by phishing email that appears tied to a McAfee-secured email service, then runs multiple stages of largely fileless PowerShell, storing later stages in an alternate data stream at '%PROGRAMDATA%\Windows\kernel32.dll' or in the registry and persisting via a WMI event subscription filtered for 'Win32_LogonSession' events.

Why it matters: Many organizations apply strict egress filtering to web traffic but leave DNS controls less stringent, which is exactly the gap this C2 channel exploits. The Word document drew only 6/54 AV detections, so the phishing lure and the DNS traffic may be the only places this chain is visible.

Read the original at Cisco Talos ↗

Topics
Malware
Related