Fileless PowerShell malware uses DNS as covert channel
Credit to Author: Lucian Constantin| Date: Fri, 03 Mar 2017 09:20:00 -0800
Targeted attacks are moving away from traditional malware to stealthier techniques that involve abusing standard system tools and protocols, some of which are not always monitored.
The latest example is an attack dubbed DNSMessenger, which was analyzed by researchers from Cisco Systems’ Talos team. The attack starts with a malicious Microsoft Word document distributed through an email phishing campaign.
When opened, the file masquerades as a “protected document” secured by McAfee, an antivirus brand now owned by Intel Security. The user is asked to click on the ‘enable content’ button in order to view the document’s content, but doing so will actually execute malicious scripting embedded within.
To read this article in full or to leave a comment, please click here
“Every new beginning comes from some other beginning’s end.” That’s the last line of the song “Closing Time” by the band Semisonic. The TippingPoint team is no stranger to new beginnings. Our latest “new beginning” began almost a year ago when Trend Micro acquired us from Hewlett Packard Enterprise. The second part of our new…
