New fileless malware uses DNS to pull down instructions

DNSMessenger malware gets instructions via Domain Name System inquiries, meaning it flies under the radar in most networks.

A new, very stealthy malware variant uses the internet’s address directory to covertly pull down commands from its authors, which then are directly implemented by victimized computers — leaving no trace on the hard drive for digital detectives to analyze.

DNSMessenger, as the malware’s been dubbed by threat researchers at Talos Group, was initially discovered by a researcher with the Twitter handle @simpo13. He tweeted at Talos about his discovery after discovering that the source code of a portion of the malware contained a character string that decoded as: “SourceFireSux.” SourceFire was the original name of one of the components of the Talos Group, which is now part of Cisco.

The DNS or domain name system looks up a written website address like www.cyberscoop.com and translates it into a numeric internet protocol (IP) address that takes a web browser or other application to the correct internet server.

DNSMessenger is a remote access tool, or RAT — malware that enables an attacker to take control of an infected machine. Talos researchers highlighted the malware’s exceptional stealth, attributing it to “an attacker who has taken significant measures to avoid detection.”

The malware arrives in a specially engineered word document, disguised as an attachment, and the victim is prompted to “click enable content,” with the promise that “This document is secured by McAfee.”

“This is likely an effective way to increase the odds of the victim opening the file and enabling macros as McAfee is a well known security vendor and likely immediately trusted by the victim,” write the researchers.

Once opened and enabled, the document launches a Visual Basic for Applications macro that starts a PowerShell session. The VBA script also reaches out out to a command and control server via DNS, importing new commands for each stage of the PowerShell attack.

There are no files written onto the target machine’s hard drives and most enterprises don’t monitor or filter DNS queries so the malware is capable of operating completely under the radar.

“This is an extremely uncommon and evasive way of administering a RAT,” wrote researchers Edmund Brumaghin and Colin Grady. “It also illustrates the importance that in addition to inspecting and filtering network protocols such as HTTP/HTTPS, SMTP/POP3, etc. DNS traffic within corporate networks should also be considered a channel that an attacker can use to implement a fully functional, bidirectional C2 infrastructure.”

Their blog post gives no information about who might have been attacked with DNSMessenger.

“We don’t have a ton on the initial vector,” said Craig Williams, senior technical leader and global outreach manager for Cisco Talos, in an email to CyberScoop. “It’s fairly targeted.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure