C&C&C? As noted by Softpedia, the Kasidet malware family, also known as Neutrino, is now able to conceal its command-and-control servers, making it even more difficult for researchers to track down data dumps and stolen information repositories.

The trick is made possible by the use of DNS service Dot-Bit, hosted via the Namecoin blockchain. Are concealed C&C servers the next logical step for malware-makers?

Concealing C&C Servers

It all started last September when security firm Dr. Web discovered a new strain of PoS malware called Trojan.MWZLesson. Further investigation, however, revealed the Trojan was actually a form of Neutrino DDoS malware that came with a built-in point-of-sale (POS) memory scraper module.

The module was only deployed if Neutrino infections detected the presence of POS software, in turn obfuscating the transit path of stolen data. In combination with the ability to intercept GET and POST requests across Firefox, Chrome and Internet Explorer, Neutrino had more than enough computing clout to grab data, transfer it off-site and disappear without detection.

Now, the memory scraper has received an update to leverage the Dot-Bit service. This tool lets cybercriminals create .bit domains that link back to specific computers and are only accessible using software known as NMControl.

Much like the Tor browser is required to open .onion links, without NMControl it’s an uphill battle to discover exactly where C&C servers are hosted.

Not the Final Stop

Neutrino isn’t the first to use Namecoin, and it won’t be the last. More importantly, as evidenced by its own updates, this isn’t the final stop for C&C server concealment. As security pros crack down on Dot-Bit links, criminals will find other options for obfuscation.

Consider the shutdown of a recent Cerber ransomware campaign. As noted by SC Magazine, a coordinated effort from security firm FireEye, CERT-Netherlands and multiple web hosting companies managed to identify and shut down the ransomware’s C&C server.

It’s a big win. As noted by FireEye malware researchers Ankit Anubhav and Raghuv Ellur, “with the attacker-controlled servers offline, macros and other malicious payloads configured to download are incapable of infecting users with ransomware.”

But what happens when cybercrimals become more adept at keeping C&C servers beyond the reach of researchers?

cuteRansomware Is Anything But Adorable

Then there’s cuteRansomware, a malware based on the my-little-Ransomware source code. According to Infosecurity Magazine, it uses a Google Doc to host both the decryption key and command-and-control functions.

With criminals now seeing greater success with cloud-based attacks — and considering the difficulty of banning a service like Google Docs across corporate networks — the cuteRansomware attack is anything but adorable. But things gets downright ugly once the notion of C&C obfuscation becomes a possibility.

It’s the ideal scenario for attackers: Agile resources hosted on highly trusted sites are almost impossible to track to their origin point. Companies may spend substantial time and effort looking for geographically distant attack servers when they’re actually hiding in plain sight.

Another “C” in the C&C model isn’t really a surprise, but presents a new problem: If security pros can’t find the destination, defeating malware takes a backseat to damage control.