Security researchers at Palo Alto Networks have observed a cyber attack by APT group Wekby on a US-based organisation using a new technique known as DNS tunneling. This method uses DNS requests as a form of command and control, thus enabling them to infect networks with malware from the 'Poison Ivy' family. This is 255 of a series of attacks by Wekby, who have been in existence for several years, targeting high-profile industries including healthcare, defence and telecoms. Their use of DNS tunneling signals a shift from the traditional HTTP method of command and control to the use of a protocol that transfers data, albeit slowly, although this is often preferred by hackers who take a long term approach to this form of attack.
Security researchers at Palo Alto Networks have observed a cyber attack by APT group Wekby on a US-based organisation using a new technique known as DNS tunneling. This method uses DNS requests as a form of command and control, thus enabling them to infect networks with malware from the 'Poison Ivy' family. This is one of a series of attacks by Wekby, who have been in existence for several years, targeting high-profile industries including healthcare, defence and telecoms. Their use of DNS tunneling signals a shift from the traditional HTTP method of command and control to the use of a protocol that transfers data, albeit slowly, although this is often preferred by hackers who take a long term approach to this form of attack.