Detecting DNS Data Exfiltration
Summary: Cisco Talos researchers describe how modeling the distribution of DNS subdomain lengths can surface data exfiltration, citing the Wekby and Point of Sale malware that used DNS requests as a command and control channel. Their analysis flagged domains with subdomains of 231 and 233 characters, each unique subdomain queried only once and each lookup returning 192.168.0.1, linking the previously unknown amouc.com and beevish.com to dojfgj.com, a known Multigrain malware domain that exfiltrates stolen credit card numbers using base32 encoding.
Why it matters: Multigrain was already walking stolen credit card numbers out of infected machines through DNS lookups that returned 192.168.0.1, and two of the three domains involved had never been seen before - a reminder that the channel your resolvers trust is also a channel an attacker can use.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026