DNS Deep Dive: Peeking into Back Doors to Abandoned but Live Backdoors

Backdoors allow threat actors to bypass a target organization’s normal authentication mechanisms.¹ Most of these malware steal sensitive information and send it to command-and-control (C&C) servers—domains under the attackers’ control.

Did you ever wonder what happens to domains that served as C&C servers? Many of them remain operational and can be accessed by other threat actors.²

Security researchers recently identified 34 domains as indicators of compromise (IoCs) for such a threat.³ The WhoisXML API research team expanded that list and uncovered 1,360+ connected artifacts comprising:

• 498 email-connected domains
• 10 IP addresses, eight of which turned out to be malicious
• 192 IP-connected domains
• 666 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/what-is-a-backdoor-attack/
• [2] https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/
• [3] https://otx.alienvault.com/pulse/677fedbe255c99f3fe95d33e