New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks

May 01, 2023Ravie Lakshmanan

An evaluation of over 70 billion DNS information has led to the invention of a brand new refined malware toolkit dubbed Decoy Dog focusing on enterprise networks.

Decoy Dog, because the title implies, is evasive and employs methods like strategic area getting older and DNS question dribbling, whereby a collection of queries are transmitted to the command-and-control (C2) domains in order to not arouse any suspicion.

“Decoy Dog is a cohesive toolkit with quite a few extremely uncommon traits that make it uniquely identifiable, significantly when inspecting its domains on a DNS stage,” Infoblox mentioned in an advisory revealed late final month.

The cybersecurity agency, which recognized the malware in early April 2023 following anomalous DNS beaconing exercise, mentioned its atypical traits allowed it to map extra domains which are a part of the assault infrastructure.

That mentioned, the utilization of Decoy Dog within the wild is “very uncommon,” with the DNS signature matching lower than 0.0000027% of the 370 million lively domains on the web, in response to the California-based firm.

One of the chief parts of the toolkit is Pupy RAT, an open supply trojan that is delivered by way of a technique referred to as DNS tunneling, during which DNS queries and responses are used as a C2 for stealthily dropping payloads.

It’s value noting that the usage of the cross-platform Pupy RAT has been linked to nation-state actors from China reminiscent of Earth Berberoka (aka GamblingPuppet) previously, though there is no proof to recommend the actor’s involvement on this marketing campaign.

Further investigation into Decoy Dog means that the operation had been arrange not less than a yr previous to its discovery, with three distinct infrastructure configurations detected up to now.

Another essential facet is the weird DNS beaconing habits related to Decoy Dog domains, such that they adhere to a sample of periodic, however rare, DNS requests in order to fly below the radar.

“Decoy Dog domains may be grouped collectively primarily based on their shared registrars, title servers, IPs, and dynamic DNS suppliers,” Infoblox mentioned.

“Given the opposite commonalities between Decoy Dog domains, that is indicative of both one menace actor steadily evolving their techniques, or a number of menace actors deploying the identical toolkit on totally different infrastructure.”