Trusted Design

Evasive Maneuvers by Wekby with Rop-packing, DNS Covert Channels

概要

ThreatStream Labs recently became aware of a campaign beginning on 30 June 2015 by the omniprescent Wekby threat actors (a/k/a TG-0416, APT-18, Dynamite Panda). The Wekby actors have recently been observed compromising organizations in the Manufacturing, Technology and Utilities verticals, but have had a long standing interest in the HealthCare industry. This campaign uses obfuscated variants of the HTTPBrowser tool that use DNS as a control channel. This recent campaign exhibits many of the groups key characteristics to deliver a more technically advanced version of their toolkit than has previously been found. The Wekby group is keen on using phishes that purport to be from the IT helpdesk, often with links or attachments claiming to be vpn or citrix upgrades. This specific instance used a “cisco” vpnclient theme.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• EVASIVE MANEUVERS BY THE WEKBY GROUP (score: 0.88)
• OilRig Deploys ALMA Communicator – DNS Tunneling Trojan (score: 0.64)
• NetTraveler APT Targets Russian, European Interests (score: 0.63)
• #1020 Dissecting the Malware Involved in the INOCNATION Campaign (score: 0.62)
• Terracotta VPN: Enabler of Advanced Threat Anonymity (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る