Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Rovnix and the Declaration Generation Algorithm

Summary: Unit 42 reports that the latest Rovnix malware variant used the text of the US Declaration of Independence, pulled from constitution.org, as an input to its domain generation algorithm rather than embedding the text in the malware itself. Between March and September, WildFire picked up 279 distinct samples that contacted that URL, with June and July each seeing well over 10,000 sessions, mostly email attacks using Polish-language invoice themes, and the malware has since stopped using this DGA in favor of a fixed command-and-control domain.

What's compelling: The attacker's DGA depended on a page they did not control, so a change by The Constitution Society could have disrupted it, and an HTTP request to that URL is now a potential infection indicator on any network that is not full of constitutional scholars.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related