Comnie Continues to Target Organizations in East Asia
Summary: Unit 42 reports that the Comnie remote backdoor malware family, in the wild since at least April 2013, has continued low-volume attacks against East Asian organizations, with November 2017 activity most likely aimed at Aerospace and Defense targets in South Korea and earlier 2017 attacks against Telecommunication, Defense, and High-Tech targets in Taiwan. Comnie retrieves command-and-control information from legitimate third-party services including github.com, tumblr.com, and blogspot.com, and is delivered through malicious macros that hide decoy documents until the victim enables macros.
Bottom line: Comnie's use of legitimate online services as a dead drop resolver lets it bypass DNS-based blocking and other security preventions, and the attackers have kept the same architecture and operations for years while staying below the security community's radar.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026