No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

Tags

External References

• https://unit42.paloaltonetworks.com/
• https://unit42.paloaltonetworks.com/
• https://otx.alienvault.com/

Description

This article analyzes four previously undisclosed DNS tunneling campaigns identified through a new campaign monitoring system. The system detects tunneling domains based on common techniques and attributes used in malicious campaigns. Four new campaigns were uncovered: FinHealthXDS (targeting finance and healthcare), RussianSite (over 100 domains sharing a Russian nameserver), 8NS (domains with 8 NS records), and NSfinder (domains combining words ending in 'finder'). The campaigns exploit DNS protocol vulnerabilities to establish covert communication channels for data exfiltration and infiltration. Common attributes within campaigns include shared infrastructure, DNS configurations, payload encoding methods, domain registration patterns, and attack targets. The monitoring system has been implemented in Palo Alto Networks' Advanced DNS Security service to provide enhanced protection against emerging DNS tunneling threats.

Date