Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, including Cobalt Strike, DNSCat2, and Iodine, discussing their prevalence and unique characteristics. It also highlights Infoblox's Threat Insight machine learning algorithms, which can detect and block tunneling domains within minutes. The study provides insights into the detection rates of different tunneling families and discusses the challenges in differentiating between legitimate and malicious DNS traffic.

This threat analysis focuses on the exploitation of the Domain Name System (DNS) protocol as a covert command-and-control (C2) communication channel and data exfiltration vector. Cybercriminals leverage DNS tunneling techniques to encapsulate malicious traffic within DNS queries and responses, effectively bypassing traditional network security controls that often allow DNS traffic by default. The analysis highlights several DNS tunneling tool families, including Cobalt Strike, DNSCat2, Iodine, Weasel, and Sliver, each with unique operational characteristics but sharing the common goal of stealthy communication with compromised hosts.

DNS tunneling works by encoding data into DNS query payloads, which are sent to attacker-controlled domains. The attacker’s DNS servers decode these queries to receive commands or exfiltrated data and respond with encoded DNS answers. This method is particularly effective because DNS traffic is ubiquitous, often unmonitored or insufficiently inspected, and allowed through firewalls and proxies. The analysis also discusses the challenges defenders face in distinguishing legitimate DNS traffic from malicious tunneling, given the legitimate use of DNS for various services.

The report references Infoblox’s Threat Insight machine learning algorithms, which have demonstrated the capability to detect and block tunneling domains within minutes. This detection leverages behavioral analysis and anomaly detection to identify patterns consistent with tunneling activity. The study provides detection rate insights for different tunneling families, underscoring the importance of advanced analytics in mitigating this threat. Indicators of compromise (IOCs) include a range of suspicious domains and IP addresses associated with tunneling activity, such as "dns-blast.com" and multiple "efficientip" domains across various TLDs, some of which are European country code TLDs (.at, .it).

While no known exploits in the wild are reported, the medium severity rating reflects the potential for significant impact if DNS tunneling is successfully employed in targeted attacks. The threat leverages a legitimate protocol, making it a subtle and persistent risk vector for organizations worldwide.

Detailed information about DNS: A Small but Effective C2 system. Get real-time updates, technical details, and mitigation strategies.

DNS: A Small but Effective C2 system - Live Threat Intelligence - Threat Radar | OffSeq.com

DNS: A Small but Effective C2 system

Threats Tagged 'dns exfiltrator'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'dns exfiltrator'

Lead Pen Test Professional