Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New Wekby Attacks Use DNS Requests As Command and Control Mechanism

Summary: Unit 42 Palo Alto Networks reported an attack by the APT group Wekby against a US-based organization, delivering a malware family it named 'pisloader' from the URL globalprint-us[.]com/proxy_plugin.exe, which was still active at the time of writing. The dropper sets persistence via the HKCU Run registry key, drops an XOR-decrypted lsm.exe payload, and uses DNS TXT record requests to a hardcoded C2 host, ns1.logitech-usa[.]com, as its command and control channel.

Key Takeaway: Wekby is known for using newly released exploits shortly after they become available, and pisloader's DNS-based C2 lets it bypass security products that do not inspect that traffic correctly - while the domains in this attack were all registered shortly before use.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related