A new backdoor malware called Mozart is using the DNS protocol to communicate with remote attackers to evade detection by security software and intrusion detection systems. The researchers have discovered that the malware uses DNS to receive instructions from attackers and to evade detection. Typically when a malware phones home to receive commands that should be executed, it will do so over the HTTP/S protocols for ease of use and communication but this can be detected by security software.
New Mozart Malware Gets Commands, Hides Traffic Using DNS – by @LawrenceAbramshttps://t.co/mJPukTckoD
— BleepingComputer (@BleepinComputer) February 24, 2020
Experts Comments
February 26, 2020
Using the DNS protocol for malware command and control operations can have advantages for cyber criminals. Using DNS can allow the attackers to bypass outbound communication restrictions or web filters and many organizations don’t have tools in place to monitor or alert on suspicious DNS traffic. However, the DNS protocol itself is unencrypted and is much easier to monitor than encrypted HTTPS. This makes it easier for defenders to build detection signatures to flag common command encoding.....Read More
Like(
February 26, 2020
This type of attack is supporting evidence that criminal hackers are evolving their tactics, tools and procedures to elude the cybersecurity control systems of organizations. By using DNS to collect information from .txt files, represents another way to transmit the commands needed from the criminal groups command and control (C2) servers. Organizations with a robust cybersecurity program should be monitoring the DNS and HTTP/S traffic from their endpoints, but now need to add further scrutiny .....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Andre Gironda, VP, provides expert commentary at @Information Security Buzz.
"This new Mozart must not be confused with this older, unrelated variety...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/newly-composed-mozart-malware-found-to-be-highly-evasive-expert-insight
Facebook Message
@Andre Gironda, VP, provides expert commentary at @Information Security Buzz.
"This new Mozart must not be confused with this older, unrelated variety...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/newly-composed-mozart-malware-found-to-be-highly-evasive-expert-insight