Wekby hacker gang using DNS requests in new malware campaign

[steven36]

A long-time hacker group is using DNS requests as a command-and-control mechanism in a new series of malware attacks, according to researchers at Palo Alto Networks.

 

 

The APT group Wekby, which have attacked numerous U.S. targets, usually pounce as soon as exploits are revealed. Palo Alto has dubbed the new malware family "pisloader," and said it is similar to the HTTPBrowser malware family. Additionally, it uses a number of obfuscation strategies to avoid the probing eyes of researchers.

 

It was delivered via HTTP from a still-active URL and the initial dropper contained simple code "that is responsible for setting persistence via the Run registry key, and dropping and executing an embedded Windows executable," according to Palo Alto. This delivers the payload.

 

Another distinguishing characteristic of the pisloader malware family, Palo Alto said, is its use of return-oriented programming and other anti-analysis tactics.

 

The Wekby group is still active, the researchers said.

 

The Source