Matryoshka packets
Summary: Cisco Talos examined a malware sample that uses ICMP echo or UDP port 53 packets to carry command-and-control traffic, embedding a full TCP SYN packet with Ethernet, IP, and TCP headers in each payload. Talos built Snort rules SIDs 24087 and 24088 that match the fixed header fields at consistent offsets, with ClamAV coverage under the name Trojan.Win32.Bledoor.
Bottom line: The tunnel hides a complete TCP SYN inside ICMP and DNS-port traffic, so detection depends on inspecting payloads at fixed offsets rather than blocking the protocols outright. Talos notes it rarely sees this technique in the wild and found no other samples using it across several months of sandbox traffic, which means most environments have little tested detection for it.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026