US Edition
Hackers exploit a blind spot by hiding malware inside DNS records
INTERNET, JUL 16 – Cybercriminals use DNS tunneling to hide malware in TXT records, enabling stealthy command-and-control and data theft while bypassing most security tools, researchers report.
- Researchers recently discovered hackers hiding malicious binaries inside DNS TXT records to distribute Joke Screenmate malware on multiple subdomains.
- This technique exploits DNS’s overlooked role in security, leveraging encrypted protocols like DOH and DOT and poorly monitored DNS traffic as a covert delivery channel.
- DomainTools found malware encoded in hexadecimal fragments across DNS subdomains, allowing attackers to retrieve and reassemble binaries via innocuous DNS requests.
- Patrick Sullivan said DNS posture management helps identify misconfigurations before adversaries exploit them, with typical scan results visible within ten minutes.
- The findings imply that enterprises must improve DNS visibility and hygiene to prevent stealthy attacks that bypass most defenses and cause catastrophic breaches when DNS fails.
12 Articles
12 Articles
They have discovered a technique in which malware hides in DNS TXT records and is rebuilt with the help of AI, a threat that even evades the most advanced security systems.
Hackers exploit a blind spot by hiding malware inside DNS records
Hackers are stashing malware in a place that’s largely out of the reach of most defenses—inside domain name system (DNS) records that map domain names to their corresponding numerical IP addresses. The practice allows malicious scripts and early-stage malware to fetch binary files without having to download them from suspicious sites or attach them to emails, where they frequently get quarantined by antivirus software. That’s because traffic for…
It seems even DNS records can be infected with malware now - here's why that's a major worry - WorldNL Magazine
(Image credit: Shutterstock.com) Researchers found evidence of Joke Screenmate malware hiding on DNS serversJoke Screenmate is a harmless, prank malwareThere are ways to defend against itHackers found a way to hide malware in the Domain Name System (DNS), cleverly evading detection and flying under the radar. This is according to security researchers from Domain Tools who, in a recent blog, detailed how they discovered the Joke Screenmate malwa…
Do you know the joke about DNS? Well, that's really the problem since hackers have found how to hide a malware directly in DNS records. It's witchcraft, you'll see! DomainTools researchers have just discovered the new version of a technique that consists of storing malware in the DNS TXT records. You know, these are those small text fields that are normally used to prove that you own a domain when you configure Google Workspace or something else.
Coverage Details
Bias Distribution
- 75% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
