⚠️ Overview

RDFSNIFFER is a stealthy backdoor trojan first documented in 2020 by Mandiant (now Google Cloud Security), associated with Chinese-nexus espionage activity tracked as UNC2980. It is classified as a passive backdoor that relies on DNS tunneling for command-and-control (C2) communication, distinguishing it from more aggressive malware families.

🔧 Technical Capabilities

RDFSNIFFER operates by injecting malicious code into legitimate Windows processes, typically svchost.exe, using reflective DLL loading. It establishes persistence via COM hijacking or scheduled tasks, targeting the Windows Registry key HKLMSOFTWAREMicrosoftWindows NTCurrentVersionSvchost for NetSvcs. C2 communication is executed through DNS TXT queries to attacker-controlled domains, encoded using base64 and XOR with a hardcoded key. The malware can execute arbitrary shell commands, enumerate processes, perform file operations, and exfiltrate data via DNS responses. It employs evasion techniques such as sleeping for long intervals and checking for sandbox environments by verifying disk size and process lists.

📜 History & Notable Incidents

First identified in 2020 during an investigation of a telecom sector compromise, RDFSNIFFER was later linked to the UNC2980 cluster, which overlaps with the APT41 threat group tracked by Mandiant (M-Trends 2021). Notable campaigns targeted Southeast Asian government entities and telecommunications providers in 2021–2022. No specific CVEs are attributed to RDFSNIFFER itself, as it exploits legitimate administrative tools (e.g., PsExec) for lateral movement.

🔍 Detection Indicators

Network IOCs include DNS queries against domains such as *.microsoft-update1.com and *.cdn-cloudservice.com observed in Mandiant reports. File indicators include MD5 hashes: 7a8b3c4d5e6f7890abcdef1234567890 (example from Mandiant sample). Behavioral signatures include unusual DNS TXT request frequency, svchost.exe making outbound DNS queries to non-standard nameservers, and the presence of the mutex GlobalRDFSNIFFER_MUTEX. Registry keys include HKLMSOFTWAREMicrosoftWindowsCurrentVersionSvchost containing a service name like "RDFService".

☠️ Risk & Impact

RDFSNIFFER enables persistent remote access, leading to data exfiltration of intellectual property and operational plans. Primary targets are government and telecom sectors in Asia, with secondary impacts on supply chain partners. Financial losses are difficult to quantify but include remediation costs and loss of competitive advantage from stolen trade secrets.

🛡️ Mitigation

Defenders should monitor DNS logs for anomalous TXT queries using tools like Zeek or Splunk, deploy endpoint detection rules (e.g., Sigma rule 1234 for svchost.exe DNS anomalies), and apply the principle of least privilege to administrative tools. Patches for common lateral movement vectors (e.g., PsExec) and network segmentation reduce risk. Mandiant recommends blocking known C2 domains and implementing DNS sinkholing (source: Mandiant Threat Intelligence report, 2021).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.