Hackers Hide Malware In DNS Records To Evade Detection

Cybersecurity researchers have discovered a new, stealthy hacking technique, which hides malware inside DNS records.

Attackers use this technique to evade traditional security tools by embedding dangerous code in areas that most systems do not inspect, as first reported by ArsTechnica.

The Domain Name System (DNS) functions as a system that converts website names into IP addresses. Hackers now employ DNS as an unorthodox data storage solution.

Researchers at DomainTools detected attackers embedding malware within TXT records of the domain whitetreecollective[.]com. The records, which serve to prove website ownership, contained numerous small text fragments which, when merged, formed malicious files.

The malware included a file for ‘‘Joke Screenmate’’, which functions as a type of nuisance software that disrupts normal computer use. The attackers transformed the file into hexadecimal format before distributing it through various subdomains. A network administrator who possesses access to the system can quietly gather these chunks through DNS requests that appear harmless.

“Even sophisticated organizations with their own in-network DNS resolvers have a hard time delineating authentic DNS traffic from anomalous requests, so it’s a route that’s been used before for malicious activity,” said Ian Campbell, senior security operations engineer at DomainTools, as reported by ArsTechnica.

“The proliferation of DOH and DOT contributes to this by encrypting DNS traffic until it hits the resolver, which means unless you’re one of those firms doing your own in-network DNS resolution, you can’t even tell what the request is, no less whether it’s normal or suspicious,” Campbell added.

Campbell discovered that certain DNS records served as platforms to execute prompt injection attacks against AI chatbots. These hidden commands attempt to trick bots into leaking data or disobeying rules.

Said Campbell: “Like the rest of the Internet, DNS can be a strange and enchanting place.”