Decoy Dog Malware - a Refresh of Pupy RAT
Recently, cybersecurity researchers have conducted a thorough investigation into a newly discovered malware named Decoy Dog and found that it represents a significant improvement over the Pupy RAT, an open-source remote access trojan that served as its foundation.
According to a report released by Infoblox, Decoy Dog boasts a range of powerful and previously unknown capabilities. Notably, it possesses the ability to transfer victims to an alternate controller, thereby enabling ongoing communication with compromised machines and facilitating extended periods of concealment. Astonishingly, certain victims have maintained active communication with a Decoy Dog server for over a year.
Decoy Dog Updated With New Capabilities
Among its newly added features, Decoy Dog can execute arbitrary Java code on the client and establish connections with emergency controllers using a mechanism reminiscent of the traditional DNS domain generation algorithm (DGA). This mechanism ensures that Decoy Dog domains can effectively respond to replayed DNS queries from breached clients.
Dr. Renée Burton, the head of threat intelligence at Infoblox, emphasized that Decoy Dog offers functionalities that were not present in Pupy. Of particular note is a command that directs the compromised device to cease communication with the current controller and instead engage with a different one. This discovery was made possible through statistical analysis of the DNS queries.
The malware's discovery dates back to early April 2023, when Infoblox detected unusual DNS beaconing activity, uncovering its targeted attacks against enterprise networks. The exact origins of Decoy Dog remain shrouded in mystery, but it is suspected to be the work of a select group of nation-state hackers. Despite using distinct tactics, these threat actors respond to inbound requests that match the communication structure of clients.
Decoy Dog functions by exploiting the domain name system (DNS) to carry out its command-and-control (C2) operations. Compromised endpoints communicate with a controller (or server) via DNS queries and IP address responses, receiving instructions in the process.
In response to earlier disclosures, the threat actors have swiftly adapted their attack infrastructure. They have taken down certain DNS nameservers and registered new replacement domains to ensure remote persistence.
Initial Decoy Dog Deployment Dates to 2022
The first known instance of Decoy Dog deployment dates back to late March or early April 2022, followed by the detection of three other clusters under the control of different controllers. As of now, a total of 21 Decoy Dog domains have been identified.
Adding to the intrigue, a set of controllers registered since April 2023 has incorporated geofencing as a technique to limit responses to client IP addresses from specific locations. Notably, observed activity has been restricted to Russia and Eastern Europe.
