Cybersecurity researchers in Infoblox’s Threat Intelligence Group have discovered a new Remote Access Trojan (RAT) lurking in corporate networks around the world, claiming it has been operating undercover for about a year.
The researchers named the RAT Pupy and were able to trace its toolkit back to Russia. We now believe that state-sponsored actors are behind the campaign.
In a press release, Infoblox researchers said they found a serious security threat communicating with malware. (opens in new tab) A toolkit called “Decoy Dog”.
Russian IPs The toolkit communicates with Russian IPs and targets organizations around the world (US, Europe, South America, Asia). Companies targeted by this new RAT include companies in technology, healthcare, energy, finance, and other sectors.
RATs “are not a typical consumer device threat.” This was primarily because it was very difficult to detect activity on compromised endpoints.
“This C2 communication was very difficult to find due to the small amount of data queries in the large DNS data pool,” the researchers claim. “This RAT uses DNS as a C2 channel for malicious actors to control internal devices.”
Pupy is an open-source project, and the researchers further claim that it is “consistently associated” with state actors.
The identity of the attacker and the nature of the breach are unknown at this time, and Infoblox added that it is currently working with other cybersecurity vendors to uncover these details.
“Organizations with a protective DNS can block these domains immediately, further mitigating risk while conducting further investigations,” the report concludes. Here is a list of C2 domains that should be blocked to mitigate potential risk.
claude front[.]Net on the allow list[.]Net atlas update[.]Com ads-tm-glb[.]click cbox4[.]ignore list[.]Com hsdps[.]cc It is here best firewall (opens in new tab) around to keep you safe 
websitebuildersnow
GIPHY App Key not set. Please check settings