The use of text mode as an alternative Domain Name System (DNS) resource record type is giving the Glimpse malware a greater ability to evade detection, security researchers have discovered.

Full details on how the malware’s script works remain unclear, but it is written in PowerShell, executed in Visual Basic and is associated with the APT34 group, according to a blog post published by IronNet. It is also similar to malware dubbed PoisonFrog, in that it communicates with its controller by using “A” resource records. Glimpse, however, uses fewer transactions to provide tasking by using text mode, researchers said.

DNS as Network Disguise

Once it has managed to infect a particular machine and checks for a directory and lock file, Glimpse deletes the file if it is older than 10 minutes and creates a new one. If it is operating in text mode, the malware then transmits a DNS query it has manually created over a UDP Socket.

Random data is inserted into the query string with the AdrGen function as the malware tests its ability to send and receive between the infected machine and the cybercriminals’ command and control (C&C) server.

All this means that Glimpse can use something other than existing .NET DNS libraries, which researchers said shows how well the authors of such threats, including PoisonFrog, can change up their approach to achieve a specific objective. Given the level of DNS traffic that runs over corporate networks, Glimpse’s techniques make it far easier for it to be overlooked by IT security teams.

The Best Way to Spot Glimpse

The researchers suggested that chief information security officers (CISOs) could possibly avoid such threats by trying to recognize the randomness in subdomain levels by performing what are known as entropy calculations. They admitted, however, that this approach might not be comprehensive enough to know with certainty that the traffic in question is laden with malware.

Other options include the use of ahead-of-threat detection, which can help organizations spot phishing websites that might lead to malware like Glimpse that winds up on the network. A solid traffic analytics platform, meanwhile, can provide real-time alerts as well as attack prediction.

More from

Beyond Requirements: Tapping the Business Potential of Data Governance and Security

3 min read - Doom and gloom. Fear, uncertainty and doubt. The "stick" versus the "carrot". What do these concepts have in common? They have often provided the primary motivation for organizations’ data governance and security strategies. For the enterprise, this mindset has perpetuated the idea that data governance, data security and data privacy are reactive cost centers existing due to externally imposed requirements or mandates.Yet, what if data governance and security practices could upend the prevailing paradigm and demonstrate direct business value?[button link="https://community.ibm.com/community/user/security/events/event-description?CalendarEventKey=8d7fdc61-97bf-43b0-b7d6-018756e436a6&CommunityKey=aa1a6549-4b51-421a-9c67-6dd41e65ef85&Home=%2fcommunity%2fuser%2fsecurity%2fcommunities%2fcommunity-home%2frecent-community-events"…

3 min read

Protecting Against Remote Monitoring and Management Phishing

3 min read - You use remote monitoring and management (RMM) software to closely monitor your cyber environment and keep your organization safe. But now cyber criminals are specifically targeting these tools, causing legitimate software to become a vulnerability. This is the latest type of attack in an increase in a recent trend of disruptive software supply chain attacks. The Cybersecurity and Infrastructure Security Agency (CISA) recently released an alert about the malicious use of legitimate remote monitoring and management (RMM) software. Last fall,…

3 min read

Secure-by-Design: Which Comes First, Code or Security?

4 min read - For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable to attack. While advocates for speed and security clash, consumers must often pay the price when threat actors strike. 48% of developers admitted they were still shipping code with vulnerabilities in 2022. It’s clearly time for a change. Many believe…

4 min read

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

7 min read