Malwarehigh
Godlua backdoor, the first bot that abuses the DNS over HTTPS (DoH)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-3396 | Server-Side Template Injection RCE in Atlassian Confluence Server and Data Center | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | liuxiaobei.com | y involved in attacks in the wild, such as the one that hit liuxiaobei[.]com domain. The experts analyzed two samples of the Godlua ba |
From the original article
2 min read at securityaffairs.com
Researchers at Network Security Research Lab of Qihoo 360 discovered a Lua-based backdoor dubbed Godlua that targets both Linux and Windows systems. The peculiarity of this new piece of malware is the ability to communicate with C2 servers via DNS over HTTPS (DoH). The DoH protocol was a new standard proposed in October 2018 and it is currently supported by several publicly available DNS servers.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.