4 ms·
Knowing more about the exfiltration component where it sends data to a remote server would be helpful. According to the article it’s sending large audio microph
by patrickhogan1 3y ago
Knowing more about the exfiltration component where it sends data to a remote server would be helpful. According to the article it’s sending large audio microphone recordings. I assume a company like Kapersky would explicit deny all outgoing network connections and then approve one by one.
- hnburnsy 3y agoThere is a series of posts on this including one that details the malware payload... https://securelist.com/trng-2023/ https://securelist.com/trng-2023/
- twobitshifter 3y agoyeah, I’m wondering the same. Maybe they can’t point a finger at who did it, but there were no clues on the exfiltration?
- hnburnsy 3y ago> yeah, I’m wondering the same. Maybe they can’t point a finger at who did it, but there were no clues on the exfiltration? From the articles at the above link... C&C domains Using the forensic artifacts, it was possible to identify the set of domain name used by the exploits and further malicious stages. They can be used to check the DNS logs for historical information, and to identify the devices currently running the malware: addatamarket[.]net backuprabbit[.]com businessvideonews[.]com cloudsponcer[.]com datamarketplace[.]net mobilegamerstats[.]com snoweeanalytics[.]com tagclick-cdn[.]com topographyupdates[.]com unlimitedteacup[.]com virtuallaughing[.]com web-trackers[.]com growthtransport[.]com anstv[.]net ans7tv[.]net