Not sleeping anymore: SOMNIRECORD's wake-up call

[[correlate]]

Content source

https://www.elastic.co/security-labs/not-sleeping-anymore-somnirecords-wakeup-call

While monitoring the REF2924 activity group, Elastic Security Labs researchers identified a new malware family written in C++ that we refer to as SOMNIRECORD. This malware functions as a backdoor and communicates with command and control (C2) while masquerading as DNS, allowing attackers to bypass network security controls such as firewalls and intrusion detection systems. Like NAPLISTENER and SIESTAGRAPH, these factors make it difficult to detect and block using strictly network-based technologies.

Not sleeping anymore: SOMNIRECORD's wake-up call

www.elastic.co