NCSC-TAD-2206-003
Reference No.: NCSC-TAD-2206-003CVSS 0
A New .NET-based DNS Backdoor Used by Lyceum
- Threat Type:
- N/A
- TLP:
- CLEAR
- CVE:
- N/A
Overview
An Iranian Advanced Persistent Threat (APT) actor known as Lyceum is using a custom .NET-based DNS backdoor in a campaign targeting the Middle East, especially the energy and telecommunication sectors. The backdoor is a customized version of the open-source DIG.net tool. The attack chain uses a Microsoft macro document downloaded from “news-spot[.]live” to execute malicious code and establish persistence through the Windows Startup folder. The malware can upload and download files and remotely execute system commands.
Affected Technologies
- Microsoft macro documents
- Windows systems
- DNS servers
Mitigation and Immediate Actions
- 01
DNS access should be limited with a multi-factor and a reliable firewall to limit access to the organization's DNS.
- 02
Verify and examine the DNS setting of the router and its passwords should be updated regularly.
- 03
Prevent website cache poisoning by randomizing user identity, server source ports, and using both upper and lower cases in the organization’s domain name.
- 04
Examine the DNS for any vulnerabilities and immediately patch them up to prevent attacks.
- 05
Users should frequently change their passwords, install and update their computer, uses anti-viruses, and use reliable virtual private networks.
- 06
Use client locks to disable changing of DNS records unless the request is made from a particular IP address.
References
- Ellis, S. (2020, August 18). DNS Hijacking. Retrieved from Office1(opens in a new tab)
- Iran-linked Lyceum APT group uses a new .NET-based DNS backdoor to target organizations in the energy and telecommunication sectors. (2022, June 11). Retrieved from Security Affairs(opens in a new tab)
- Lakshmanan, R. (2022, June 12). Iranian Hackers Spotted Using a new DNS Hijacking Malware in Recent Attacks. Retrieved from The Hacker News(opens in a new tab)
Impacted Sectors
- Energy
- ICT