CC-1244
Medium
Published Wednesday 8 March 2017 (12:00)
(updated 17 February 2020)
DNSMessenger - C2 Commands via DNS TXT record
A new Remote Access Trojan (RAT) has been discovered that downloads PowerShell commands stored inside a domain’s DNS TXT record. This makes it difficult to defend against, as DNS is required to resolve IP addresses to domain names.