Glimpse malware uses alternative DNS to evade detection

[dhruv2193]

Security researchers have detailed how the Glimpse malware uses a text mode as an alternative DNS resource record type.
 
According to a blog post by security researchers Jon Perez and Jonathan Lepore at IronNet, the malware is written in PowerShell and associated with APT34. It is executed by Visual Basic script, yet how the script is initiated remains unclear, researchers said.
 
They added that the malware is similar to the PoisonFrog malware. Both use "A" resource records to communicate with their controller. Glimpse differs by its ability to use text mode as an alternative DNS resource record type. This allows it to provide tasking in fewer transactions. Additionally, instead of relying on existing .NET DNS libraries, it manually crafts its DNS queries and communicates directly with the controller.

Source(full read)- https://www.scmagazineuk.com/glimpse-mal...le/1665336