انتقل إلى المحتوى الرئيسي
English
logo

NCSC-TAD-2206-003

مستوى الخطورة: عالية
برمجيات خبيثة

الرقم المرجعي: NCSC-TAD-2206-003CVSS 0

A New .NET-based DNS Backdoor Used by Lyceum

نوع التهديد:
غير متوفر
مستوى المشاركة (TLP):
CLEAR
CVE:
غير متوفر

نظرة عامة

An Iranian Advanced Persistent Threat (APT) actor known as Lyceum is using a custom .NET-based DNS backdoor in a campaign targeting the Middle East, especially the energy and telecommunication sectors. The backdoor is a customized version of the open-source DIG.net tool. The attack chain uses a Microsoft macro document downloaded from “news-spot[.]live” to execute malicious code and establish persistence through the Windows Startup folder. The malware can upload and download files and remotely execute system commands.

التقنيات المتأثرة

  • Microsoft macro documents
  • Windows systems
  • DNS servers

إجراءات الحد من المخاطر والإجراءات الفورية

  1. 01

    DNS access should be limited with a multi-factor and a reliable firewall to limit access to the organization's DNS.

  2. 02

    Verify and examine the DNS setting of the router and its passwords should be updated regularly.

  3. 03

    Prevent website cache poisoning by randomizing user identity, server source ports, and using both upper and lower cases in the organization’s domain name.

  4. 04

    Examine the DNS for any vulnerabilities and immediately patch them up to prevent attacks.

  5. 05

    Users should frequently change their passwords, install and update their computer, uses anti-viruses, and use reliable virtual private networks.

  6. 06

    Use client locks to disable changing of DNS records unless the request is made from a particular IP address.

المراجع

القطاعات المتأثرة

  • الطاقة
  • تقنية المعلومات والاتصالات