corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0879f-10e6-7092-9f66-dc498f0908be

Dns Tunneling And In The Wild Attribution

manta.black · published 27 September 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at manta.black Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
48
Words captured
1,266

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.ietf.org/rfc/rfc1034.txt
ietf.org
https://www.ietf.org/rfc/rfc1035.txt
ietf.org
https://www.cloudflare.com/learning/dns/what-is-dns
cloudflare.com
https://attack.mitre.org/groups/G0026/
attack.mitre.org
https://attack.mitre.org/groups/G0049/
attack.mitre.org
https://www.group-ib.com/blog/cobalt/
group-ib.com
https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
cybereason.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf
media.kasperskycontenthub.com
https://attack.mitre.org/groups/G0050/
attack.mitre.org
https://threatpost.com/wekby-apt-gang-using-dns-tunneling-for-command-and-control/118303/
threatpost.com
https://www.bleepingcomputer.com/news/security/darkhydrus-apt-uses-google-drive-to-send-commands-to-roguerobin-trojan/
bleepingcomputer.com
OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government Read at the source ↗
unit42.paloaltonetworks.com
https://blog.talosintelligence.com/dnspionage-campaign-targets-middle-east/
blog.talosintelligence.com
https://github.com/Arno0x/DNSExfiltrator
github.com
https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/
blog.netlab.360.com
https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/
sentinelone.com
https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/
welivesecurity.com
https://x.com/ESETresearch/status/1686394110184439808?s=20
x.com
https://www.sentinelone.com/labs/fin6-frameworkpos-point-of-sale-malware-analysis-internals/
sentinelone.com
https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf
welivesecurity.com
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
cisa.gov
https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf
cisa.gov
https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
mandiant.com
xHunt Campaign: Newly Discovered Backdoors Using Deleted Email Drafts and DNS Tunneling for Command and Control Read at the source ↗
unit42.paloaltonetworks.com
https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html
pwc.co.uk
https://attack.mitre.org/techniques/T1572/
attack.mitre.org
Understanding DNS Tunneling Traffic in the Wild Read at the source ↗
unit42.paloaltonetworks.com
https://www.daemon.be/maarten/dnstunnel.html
daemon.be
https://manta.black/ Read at the source ↗
manta.black
https://arxiv.org/pdf/1902.08454.pdf
arxiv.org
https://ieeexplore.ieee.org/document/7536939
ieeexplore.ieee.org
https://dl.acm.org/doi/pdf/10.1145/3507509.3507520
dl.acm.org
https://www.unb.ca/cic/datasets/dns-exf-2021.html
unb.ca
https://ieeexplore.ieee.org/abstract/document/8725640
ieeexplore.ieee.org
https://www.zdnet.com/article/iranian-hacker-group-becomes-first-known-apt-to-weaponize-dns-over-https-doh/
zdnet.com
DNS Tunneling: how DNS can be (ab)used by malicious actors Read at the source ↗
unit42.paloaltonetworks.com
https://www.socinvestigation.com/how-the-apt34-uses-saitama-backdoor-for-dns-tunnelling/
socinvestigation.com
https://github.com/zom3y3/slides/blob/master/ICANN67%20DOH%20in%20Godlua%20Backdoor.pdf
github.com
https://www.malwarebytes.com/blog/threat-intelligence/2022/05/apt34-targets-jordan-government-using-new-saitama-backdoor
malwarebytes.com
https://www.forcepoint.com/blog/x-labs/udpos-exfiltrating-credit-card-data-dns
forcepoint.com
https://thomer.com/howtos/nstx.html
thomer.com
https://code.kryo.se/iodine/
code.kryo.se
https://github.com/alex-sector/dns2tcp
github.com
https://github.com/iagox86/dnscat2
github.com
https://github.com/lnussbaum/tuns
github.com
https://dnstunnel.de/
dnstunnel.de
https://github.com/mubix/stuff/blob/master/stolen/ozymandns_src_0.1.tgz?raw=true
github.com
https://heyoka.sourceforge.net/
heyoka.sourceforge.net