Infoblox, the company that delivers a simplified, cloud-enabled networking and security platform for improved performance and protection, has published a threat report blog on a remote access trojan (RAT) toolkit with DNS command and control (C2).<\/p>\n\n\n\n
The toolkit created an anomalous DNS signature observed in enterprise networks in the US, Europe, South America and Asia across technology, healthcare, energy, financial and other sectors. Some of these communications go to a controller in Russia.<\/p>\n\n\n\n
Coined ‘Decoy Dog’, Infoblox\u2019s Threat Intelligence Group was the first to discover this toolkit and is collaborating with other security vendors, as well as customers, to disrupt this activity, identify the attack vector and secure global networks.<\/p>\n\n\n\n
The critical insight is that DNS anomalies measured over time not only surfaced the RAT, but ultimately tied together seemingly independent C2 communications.<\/p>\n\n\n\n
\u201cDecoy Dog is a stark reminder of the importance of having a strong, protective DNS strategy,\u201d said Ren\u00e9e Burton, Senior Director of Threat Intelligence for Infoblox.<\/p>\n\n\n\n
\u201cInfoblox is focused on detecting threats in DNS, disrupting attacks before they start and allowing customers to focus on their own business.\u201d<\/p>\n\n\n\n
As a specialized DNS-based security vendor, Infoblox tracks adversary infrastructure and can see suspicious activity early in the threat lifecycle.<\/p>\n","protected":false},"excerpt":{"rendered":"
Infoblox, the company that delivers a simplified, cloud-enabled networking and security platform for improved performance and protection, has published a threat report blog on a remote access trojan (RAT) toolkit with DNS command and control (C2). The toolkit created an anomalous DNS signature observed in enterprise networks in the US, Europe, South America and Asia […]<\/p>\n","protected":false},"author":62,"featured_media":86191,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[331,14804,809],"tags":[15858,177,15857,15856,15859,15860],"class_list":["post-86190","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-cybersecurity","category-more-news","tag-cloud-enabled","tag-infoblox","tag-rat","tag-remote-access-trojan","tag-security-platform","tag-threat-report"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/86190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/62"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=86190"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/86190\/revisions"}],"predecessor-version":[{"id":86194,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/86190\/revisions\/86194"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/86191"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=86190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=86190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=86190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}