Decoy Dog

Malware updated a month ago (2024-11-29T14:03:22.469Z)
Download STIX
Preview STIX
Decoy Dog is a notorious malware that utilizes DNS tunneling for Command and Control (C2) operations, similar to well-known campaigns like DarkHydrus, OilRig, xHunt, and SUNBURST. This malware uses the underlying tunneling tool Pupy, which applies the character '9' as padding when encoding data. First detected in late March or early April 2022, Decoy Dog has since evolved continuously to impede detection and analysis both in network traffic and file systems. The malware's unique signature indicates not just the open-source Pupy RAT but also the Decoy Dog toolkit used for deployment. The malware has exploited the often overlooked DNS oversight in networks, leading to serious cybersecurity threats. Infoblox, an industry-leading DNS Detection and Response solution provider, reported the Decoy Dog campaign in April 2023. Their president and CEO, Scott Harrell, emphasized the importance of DNS as the first line of defense against threats like Decoy Dog. However, the lack of insight into victim systems and vulnerabilities being exploited makes Decoy Dog an ongoing and severe threat, according to Dr. Renée Burton, Head of Threat Intelligence at Infoblox. Since its initial discovery, Decoy Dog has targeted various organizations, causing significant damage. At least 20 organizations in Russia, including power companies, IT firms, and government agencies, have fallen victim to this modified version of Pupy RAT. Investigations into the Decoy Dog and Pupy RAT are ongoing, highlighting the persistent threat posed by this malware. As such, it is crucial for organizations to maintain vigilance and employ robust defenses against these evolving cyber threats.
Description last updated: 2024-06-09T12:15:27.990Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
DNS
Rat
Decoy
Malware
Trojan
Infoblox
Exploit
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Decoy Dog Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
Securityaffairs
7 months ago
Unit42
7 months ago
CERT-EU
a year ago
Unit42
a year ago
Malwarebytes
2 years ago
CERT-EU
a year ago
CERT-EU
2 years ago
CERT-EU
a year ago
CERT-EU
2 years ago
CERT-EU
a year ago
CERT-EU
2 years ago
DARKReading
2 years ago
DARKReading
a year ago
CERT-EU
2 years ago
DARKReading
a year ago
CERT-EU
a year ago
CERT-EU
2 years ago
CERT-EU
a year ago
CERT-EU
a year ago
Securityaffairs
2 years ago