News

Cybercriminals that conducted DNSpoinage campaign, armed now with new malware software

Cybercriminal group that is responsible for DNSpionage operation became more selective in choosing victims and armed themselves with new malware Karkoff to improve effectiveness of their cyberattacks.

According to FireEye, DNSpionage campaing began in the end of April 2017 and for it responsible cybercriminals that act in interests of Iranian government.

In the previous attacks, with the use of fake websites and DNS breaks, intruders redirected traffic from legitimate domains on malware ones, for the latter were used free digital certificates Let’s Encrypt.

Now group armed with new instrument for remote administering with support of connection with C&C servers through HTTP and DNS, researchers from Cisco Talos.

Since release of Cisco Talos first report about DNSpionage in the end of 2018, cybercriminals enhanced their tactic.

“We discovered some changes to the actors’ tactics, techniques and procedures (TTPs), including the use of a new reconnaissance phase that selectively chooses which targets to infect with malware.”, – Cisco Talos researchers reported.

With the help of espionage methods, criminals manage to bypass protection and create digital fingerprints of system they attack.

Criminals select their victims very carefully and attack them with the use of targeted fishing. They send their victims emails with attached Microsoft Word and Excel documents that contain malware macros. During the attack, malware programs through the macros change their names for «taskwin32.exe» and create planned task «onedrive updater v10.12.5» for ensuring that malware will persist in a system.


In DNSpionage, upon opening the Excel document, users are greeted with the insult, “haha you are donkey [sic].” The broken English suggests the actor is unlikely a native English speaker.

This month researchers firstly detected in the arsenal of the group malware program on .Net under the name Karkoff. They say that malware is “lightweighted” and needs remote performing through C&C server.

Nevertheless, Karkoff possesses one interesting feature. Malware generates journal file where are stores all performed commands with time marks. So, with the use of this journal Karkoff victims can check what and when happened certain events.

Source: https://blog.talosintelligence.com

Polina Lisovskaya

I works as a marketing manager for years now and loves searching for interesting topics for you

Recent Posts

Remove Pbmsoultions.com Pop-up Ads

About Pbmsoultions.com Pbmsoultions.com pop-ups can not launch out of the blue. If you have actually…

1 day ago

Remove Prizestash.com Pop-up Ads

About Prizestash.com Prizestash.com pop-ups can not expose out of the blue. If you have actually…

1 day ago

Remove Verifiedbreaking.com Pop-up Ads

About Verifiedbreaking.com Verifiedbreaking.com pop-ups can not launch out of nowhere. If you have actually clicked…

1 day ago

Remove Themoneyminutes.com Pop-up Ads

About Themoneyminutes.com Themoneyminutes.com pop-ups can not launch out of the blue. If you have actually…

1 day ago

Remove News-xcidizi.com Pop-up Ads

About News-xcidizi.com News-xcidizi.com pop-ups can not introduce out of nowhere. If you have clicked some…

1 day ago

Remove Everytraffic-flow.com Pop-up Ads

About Everytraffic-flow.com Everytraffic-flow.com pop-ups can not launch out of nowhere. If you have actually clicked…

1 day ago