Jim Love (0:00)

Hackers hide malware and DNS records using hex encoded fragments. Custom backdoor hits, sonic wall, SMA devices, even fully patched units. US Military assumes that they've been breached after Chinese hackers target VPNs and global email servers and $27 million was stolen in the big one crypto hack this is cybersecurity today. I'm your host Jim Love. Malware delivery just got sneakier Researchers from Domain Tools recently spotted attackers using DNS records normally reserved for routine network tasks to smuggle in a piece of nuisance malware called Joke Screenmate, a strain of malware that interferes with normal and safe functions of a computer. Instead of delivering the malware as a single file, attackers converted it into hexadecimal, a compact text format using 0 to 9 and a to fix to encode messages, and embedded those fragments in DNS text records tied to malicious domains. Each time the infected system looked up one of those domains, it pulled down another sliver of the payload text format using 0 to 9 and a to F as its characters and embedded those fragments in DNS text records tied to malicious domains. Each time the infected system looked at one of those domains, it pulled down another sliver of the payload. In total, the malware made 56D DNS queries, each returning a small block of code. A script on the compromised system quietly stitched the blocks together and decoded them, reconstructing the full PowerShell malware, all without downloading a traditional binary or triggering endpoint defenses. Because DNS traffic is often overlooked and text records are typically used for harmless metadata like email authentication, this tactic bypasses most firewalls and antivirus tools. Infoblox, which also analyzed the campaign, said it reflects a growing shift towards living off the land attackers exploiting legitimate infrastructure like DNS to stay under the radar. Security teams are urged to monitor outbound DNS requests more closely, especially when they involve text records from unknown or suspicious domains. Even background protocols like DNS are no longer safe to ignore. Google has uncovered a STEALTH backdoor targeting SonicWall's SMA 100 series devices and even fully patched appliances weren't safe. The malware, dubbed Overstep, was installed by a threat group tracked as UNC6148, which exploited vulnerabilities and reused stolen credentials to maintain deep access. In some cases, credentials were harvested months before the implants were deployed, suggesting a long term staging operation. Google researchers said the attackers may have intimate knowledge of Sonicwall internals based on how precisely the malware mimicked the legitimate processes and avoided detection. The backdoor targeted SMA 200, 210, 400, 410 and 500V models, all currently end of sale but still receiving patches. The attackers deployed a rootkit that persisted across firmware upgrades by hijacking the system bootloader. As noted, the attack revealed a strong knowledge of SonicWall devices. The payload was disguised to match legitimate binaries in both name and file size. Once active, it created new admin accounts, suppressed logs, and filtered outbound traffic to avoid triggering alerts. One of The Exploited Flaws, CVE2021 20038, is a remote code execution bug rated CVSS 9.8. But Overstep didn't rely just on known bugs it likely leveraged zero day and long term credential theft. This meant even patch devices were at risk if threat actors had already gained a foothold. SonicWall has since moved the SMA100 series to end of support by December 31, 2025, and urges immediate audits of user accounts, log integrity, and bootloader configs for organizations still running these devices. Migration plans should start now. The U.S. military has ordered every branch to assume its networks are compromised after a stealth campaign by suspected Chinese hackers breached internal email servers and likely much more. The group known as Salt Typhoon or APT40, exploited vulnerabilities in Evanti Connect secure VPNs to gain access to sensitive systems. But this wasn't just a military operation, according to researchers. The same campaign targeted over 100 organizations worldwide, including defense contractors and educational institutions and critical infrastructure providers, all using the same vulnerable devices Inside the Department of Defense, Attackers moved laterally to access internal military email servers, using valid credentials and built in admin tools to stay hidden. Investigators believe some compromised accounts and credentials may have been stolen months, perhaps even as much as a year before detection, meaning the attackers were already inside when patches were finally applied. What triggered a full scale response wasn't just the intrusion, it was the methodical precision. Salt Typhoon avoided malware and instead used living off the land techniques like PowerShell, remote desktops and scheduled tasks, making them nearly invisible to traditional security tools. But on July 9, the Pentagon issued an Assume Breach directive, instructing all branches to conduct internal audits, rotate credentials and investigate for lateral movement. This warning applies even to patched systems. The breach highlights just how deep foreign cybercriminal gangs may be in networks that are essential to the defense and security of the United States and other countries. Not only defense, but telecommunications and infrastructure and others have been massively invaded over the past few years. The fact that these attacks have remained undetected for so long is also a huge cause for for concern. So just how much of the defense and critical infrastructure is still affected? It will take a massive effort to detect, expunge and protect for the future. But without such an effort, there will always be the question of how much information has been exfiltrated and how vulnerable the US Is in a world increasingly filled with global and regional conflicts. Until then, the advice is valid for most areas of US infrastructure and perhaps for the world. Assume you have been breached. Another major crypto theft has hit the books. On July 15, hackers drained $27 million in Ethereum from Big One, a Singapore based exchange, by gaining access to Hot Wallet operator keys. The attackers used the stolen credentials to authorize transfers directly from one of Big One's Internet connected wallets. Blockchain analysts from cybersecurity detected the activity in real time, watching as the stolen funds were quickly dispersed across multiple wallets, a classic laundering move to obscure the trail. The attack didn't exploit a vulnerability in smart contracts or exchange software. Instead, it was a case of key compromise. The attackers likely obtained a valid operational key or private credential with transaction authority. And that's what makes it especially dangerous, as no alarms go off until the funds are already gone. Big One says no customer funds were lost, and it will cover the damage internally. But the incident is part of a much larger trend. According to cybers, over $430 million has been stolen from crypto platforms so far this year, largely by compromising Hot Wallets, the very systems designed to enable fast, flexible transactions. Many of these attacks, they say, originate from infrastructure linked to the North Korean Lazarus Group. The Big One breach adds to the growing pressure on crypto exchanges to harden key management, rotate credentials proactively, and segment critical wallet infrastructure. Because in this environment, one leaked key can cost millions. And as an added downside leak, the funds could be a big part of supporting the rogue North Korean regime and its nuclear program. And that's our show. Love to hear your thoughts. You can reach us@technewsday.com or ca. Take your pick. Just go to the Contact Us form. Drop us a note if you're on YouTube watching this, you know what to do. Put it under the video. Thanks again to all of our listeners and supporters as we prepare to turn the dial for our 10 millionth download over the weekend. I'm your host Jim Love, and if I've said it once, I've said it a million times. Actually, several million times. Thanks for listening.