Threat video1:00
LokiBot, Xworm & Remcos Passive DNS: Detection & IOCs
Validin DNS pivots tie LokiBot, Xworm and Remcos hosts via shared ASN ranges: 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for LokiBot, Xworm & Remcos Passive DNS: Detection & IOCs →
Chapters
- 0:00The hookFour malware families shared the same infrastructure.
- 0:04The storyResearchers found iCloud lookalikes and dynamic DNS tied to LokiBot, Bagle, Xworm, Remcos.
- 0:12Attack pathAttackers registered iCloud lookalikes, rotated LokiBot across multiple IPs.
- 0:30AttributionNo threat actor is attributed.
- 0:34Indicators of compromise10 indicators to hunt: 2 IPs, 1 IP range and 7 domains.
- 0:40MITRE ATT&CK techniques6 ATT&CK techniques, from resource development to command and control.
- 0:44Remediation2 steps now: Block or sinkhole the listed domains and IPs.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Four malware families shared the same infrastructure.
0:05Researchers found iCloud lookalikes and dynamic DNS tied to LokiBot, Bagle, Xworm, Remcos.
0:12Attackers registered iCloud lookalikes, rotated LokiBot across multiple IPs.
0:18They co-hosted commodity RATs like Xworm and Remcos.
0:22Dynamic DNS hid infrastructure across ASN clusters.
0:26Cloudflare fronting masked the origin.
0:30No threat actor is attributed. Confidence: low.
0:3410 indicators to hunt: 2 IPs, 1 IP range and 7 domains.
0:406 ATT&CK techniques, from resource development to command and control.
0:452 steps now: Block or sinkhole the listed domains and IPs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.