DNS as Added Security Against Ransomware Attacks
summary
Recursive DNS logs reveal DNS tunneling used for C2 and exfiltration in real ransomware campaigns, with 78% of observed ransomware incidents using Cobalt Strike and frequent DNS beaconing via TXT, A and AAAA records. Examples show ChaChiret/Mespinosa packing protobufs, symmetric encryption and hex encoding into TXT queries, modified chashell for C2, and rapid compromise (quantum: four hours from initial loader to full encryption). Cisco Umbrella implements resolver-side session inspection and real-time blocking to flag and stop these patterns.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:31Gathering intelligence at the DNS layer
- 11:23CobaltStrike DNS beacon C2 channel over DNS
- 15:09Analyzing DNS Traffic Wireshark view of Cobalt Strike DNS traffic
- 28:12DNS Resolver (Real-time Detection) Expanded Protection against malicious tunneling tools and query techniques
- 29:17DNS Resolver (Real-time Caching Detection)
- 30:28Ransomware hardening approach
related talks
47mDNS On Fire
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
32mSurviving a Ransomware Attack - Lessons from the Field
52mRansomware 101: Get Smart Understanding Real Attacks
26mMisuse of DNS, the Second Most Used Protocol
52mPower of DNS as an Added Defense Against Modern Attacks
41mWhen Cybersecurity Is More Than Just Vulnerabilities
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?