No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

SUMMARY :

This article analyzes four previously undisclosed DNS tunneling campaigns identified through a new campaign monitoring system. The system detects tunneling domains based on common techniques and attributes used in malicious campaigns. Four new campaigns were uncovered: FinHealthXDS (targeting finance and healthcare), RussianSite (over 100 domains sharing a Russian nameserver), 8NS (domains with 8 NS records), and NSfinder (domains combining words ending in 'finder'). The campaigns exploit DNS protocol vulnerabilities to establish covert communication channels for data exfiltration and infiltration. Common attributes within campaigns include shared infrastructure, DNS configurations, payload encoding methods, domain registration patterns, and attack targets. The monitoring system has been implemented in Palo Alto Networks' Advanced DNS Security service to provide enhanced protection against emerging DNS tunneling threats.

OPENCTI LABELS :

cobalt strike,data exfiltration,icedid,dns tunneling,redline stealer,russiansite,nsfinder,8ns,covert communications,hiloti,finhealthxds


Open in NetmanageIT OpenCTI Public Instance with below link!


Use public read only username and password on login page.

NOTE : Use Public READ only user credentials on login page banner.


No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection