Security researchers at Palo Alto Networks have observed a cyber attack by APT group Wekby on a US-based organisation using a new technique known as DNS tunneling. This method uses DNS requests as a form of command and control, thus enabling them to infect networks with malware from the 'Poison Ivy' family. This is one of a series of attacks by Wekby, who have been in existence for several years, targeting high-profile industries including healthcare, defence and telecoms. The first stage of this attack, which was detected last week, used an exploit called 'Heartbleed' that allowed attackers to steal data encrypted with SSL/TLS certificates issued by major internet companies.
Security researchers at Palo Alto Networks have observed a cyber attack by APT group Wekby on a US-based organisation using a new technique known as DNS tunneling. This method uses DNS requests as a form of command and control, thus enabling them to infect networks with malware from the 'Poison Ivy' family. This is one of a series of attacks by Wekby, who have been in existence for several years, targeting high-profile industries including healthcare, defence and telecoms. Their use of DNS tunneling signals a shift from the traditional HTTP method of command and control to the use of a protocol that transfers data, albeit slowly, although this is often preferred by hackers who take a long term approach to this form of attack.