Severity
Medium
Analysis Summary
The DNSpionage malware campaign has resurfaced with a new sophisticated operation that infects selected victims with a new variant of the DNSpionage malware.
The DNSpionage attacks use compromised sites and craft malicious documents to infect victims’ computers with DNSpionage—a custom remote administrative tool that uses HTTP and DNS communication to communicate with the attacker-controlled command and control server.
With the release of Karkoff, the threat actors are more focused on evading detection and are primarily focused on targeting victims in the Middle East region.
Indicators of Compromise
URLs
Malware Hash (MD5/SHA1/SH256)
Remediation
Block the threat indicators at their respective controls.