C&C&C? As noted by Softpedia, the Kasidet malware family, also known as Neutrino, is now able to conceal its command-and-control servers, making it even more difficult for researchers to track down data dumps and stolen information repositories.

The trick is made possible by the use of DNS service Dot-Bit, hosted via the Namecoin blockchain. Are concealed C&C servers the next logical step for malware-makers?

Concealing C&C Servers

It all started last September when security firm Dr. Web discovered a new strain of PoS malware called Trojan.MWZLesson. Further investigation, however, revealed the Trojan was actually a form of Neutrino DDoS malware that came with a built-in point-of-sale (POS) memory scraper module.

The module was only deployed if Neutrino infections detected the presence of POS software, in turn obfuscating the transit path of stolen data. In combination with the ability to intercept GET and POST requests across Firefox, Chrome and Internet Explorer, Neutrino had more than enough computing clout to grab data, transfer it off-site and disappear without detection.

Now, the memory scraper has received an update to leverage the Dot-Bit service. This tool lets cybercriminals create .bit domains that link back to specific computers and are only accessible using software known as NMControl.

Much like the Tor browser is required to open .onion links, without NMControl it’s an uphill battle to discover exactly where C&C servers are hosted.

Not the Final Stop

Neutrino isn’t the first to use Namecoin, and it won’t be the last. More importantly, as evidenced by its own updates, this isn’t the final stop for C&C server concealment. As security pros crack down on Dot-Bit links, criminals will find other options for obfuscation.

Consider the shutdown of a recent Cerber ransomware campaign. As noted by SC Magazine, a coordinated effort from security firm FireEye, CERT-Netherlands and multiple web hosting companies managed to identify and shut down the ransomware’s C&C server.

It’s a big win. As noted by FireEye malware researchers Ankit Anubhav and Raghuv Ellur, “with the attacker-controlled servers offline, macros and other malicious payloads configured to download are incapable of infecting users with ransomware.”

But what happens when cybercrimals become more adept at keeping C&C servers beyond the reach of researchers?

cuteRansomware Is Anything But Adorable

Then there’s cuteRansomware, a malware based on the my-little-Ransomware source code. According to Infosecurity Magazine, it uses a Google Doc to host both the decryption key and command-and-control functions.

With criminals now seeing greater success with cloud-based attacks — and considering the difficulty of banning a service like Google Docs across corporate networks — the cuteRansomware attack is anything but adorable. But things gets downright ugly once the notion of C&C obfuscation becomes a possibility.

It’s the ideal scenario for attackers: Agile resources hosted on highly trusted sites are almost impossible to track to their origin point. Companies may spend substantial time and effort looking for geographically distant attack servers when they’re actually hiding in plain sight.

Another “C” in the C&C model isn’t really a surprise, but presents a new problem: If security pros can’t find the destination, defeating malware takes a backseat to damage control.

More from

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…