xHunt Campaign: New Power Shell Backdoor Blocked Through DNS Tunnel Detection
Summary: Unit 42 Palo Alto Networks reported that a PowerShell backdoor it named CASHY200 used DNS tunneling to communicate with a command-and-control server at windows64x[.]com, issuing DNS A queries to the actor-controlled name server and parsing commands from the DNS answers. In September 2019 a host in Kuwait beaconing to that domain with the same tunneling protocol was blocked by the DNS security service, and the researchers linked the tool to xHunt activity against Kuwait government organizations from spring 2018 through 2019.
Why it matters: The actor lost access to compromised systems the moment the DNS tunnel was blocked, which means the difference between an active intrusion and a contained one came down to whether DNS traffic to a single domain was being inspected.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026