Confucius Says...Malware Families Get Further By Abusing Legitimate Websites
Summary: Unit 42 describes two malware families, CONFUCIUS_A and CONFUCIUS_B, that resolve command-and-control addresses by pulling keywords from legitimate pages on Yahoo Answers and Quora and decoding them through an in-memory lookup table, avoiding DNS requests for domains that might be blocked. CONFUCIUS_A is linked to SNEEPY/ByeByeShell activity reported by Rapid7 in 2013 and appeared in early 2014, while CONFUCIUS_B shares the same technique and a mutex, and both clusters have likely Indian origins with targets primarily in the Middle East and Asia, focused on Pakistan.
What's compelling: The attackers' first hop never touches a malicious domain - it rides on Yahoo and Quora, so domain blocklists and DNS-based detection see nothing to flag. A single developer or development company is believed to sit behind both families, meaning the technique is reusable across operators.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026