⚠️ Overview

DnsSystem is a DNS-tunneling backdoor first documented publicly by Forcepoint Security Labs in June 2018, attributed to an advanced persistent threat (APT) group likely operating out of Eastern Europe. This malware belongs to the category of remote access trojans (RATs) and data exfiltration tools, primarily targeting Windows-based enterprise environments to bypass network security controls using DNS protocol abuse.

🔧 Technical Capabilities

DnsSystem uses DNS TXT and A record queries as its command-and-control (C2) channel, encoding commands and exfiltrated data into subdomain labels of requests sent to attacker-controlled authoritative DNS servers. It achieves persistence through a scheduled task that runs a PowerShell script stored in the Windows Registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware employs evasion techniques such as delaying DNS queries to avoid rate-limiting detection, using randomized subdomain lengths, and appending legitimate-looking domain names to its queries. It can execute arbitrary shell commands, upload files via DNS responses, and download additional payloads using similar DNS tunneling methods. Propagation occurs through spear-phishing emails containing malicious macros that download the initial PowerShell stager. DnsSystem also includes a self-update mechanism that retrieves new modules from the C2 server periodically.

📜 History & Notable Incidents

First identified in early 2018 by Forcepoint, DnsSystem was observed in campaigns targeting government agencies and telecommunications providers in Eastern Europe, particularly in Ukraine and Poland. No specific CVEs are associated with the malware itself, but it leverages common attack vectors such as obfuscated PowerShell execution and DNS tunneling techniques mapped to MITRE ATT&CK technique T1071.004 (Application Layer Protocol: DNS). No public law enforcement actions have been reported against the operators as of 2025.

🔍 Detection Indicators

Network indicators include DNS queries to domains with unusually long subdomains (often >50 characters) containing base64-encoded data, such as example-dnsystem.com (fictional) with patterns like Zm9vYmFyCg==.malicious.com. On endpoints, DnsSystem creates a scheduled task named “MicrosoftDNSUpdateTask” and writes a encoded PowerShell script to the registry key HKLMSOFTWAREMicrosoftDnsSystem. No public file hashes are available, but behavioral signatures include powershell.exe spawning nslookup.exe or Resolve-DnsName cmdlets in rapid succession.

☠️ Risk & Impact

DnsSystem poses a high risk for data exfiltration, as it can silently transmit sensitive files (e.g., credentials, documents) over DNS, a protocol often allowed through firewalls and proxies. The affected sectors include government, defense, and critical infrastructure, where loss of intellectual property and operational security can lead to significant financial and strategic damage. A single infected host can be used as a pivot point for lateral movement within the network.

🛡️ Mitigation

Defenders should implement DNS sinkholing of known malicious domains, deploy network monitoring tools that flag high-frequency or anomalous DNS queries (e.g., Zeek with the dns-tunnel-detection script), and enforce application whitelisting to block unauthorized PowerShell execution. Microsoft also recommends enabling Windows Defender Application Control and using Sysmon to log DNS events for forensic analysis.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.