Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Art of Domain Deception: Bifrost's New Tactic to Deceive Users

Summary: Unit 42 found a new Linux variant of the Bifrost RAT, first identified in 2004, that uses a typosquatted command-and-control domain, download.vmfare[.]com, to mimic a legitimate VMware domain. The sample, hosted at 45.91.82[.]127 and compiled for x86 as a stripped binary, collects hostname and IP address, encrypts the data with RC4, and resolves its C2 through a Taiwan-based public DNS resolver at 168.95.1[.]1; the same IP also hosts an ARM version, and WildFire detected more than 100 Bifrost sample hashes over the past few months.

What you should know: The deceptive domain was still undetected on VirusTotal as of late February, so a domain that reads as VMware can pass a quick human check while the RAT resolves it through a public DNS resolver to blend in. With more than 100 sample hashes in a few months and an ARM build now in circulation, the reach extends to devices that x86-only malware could not touch.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026