The Prevalence of DarkComet in Dynamic DNS

MITRE Techniques

• [T1071.004] DNS – Dynamic DNS usage for C2: “Dynamic DNS allows attackers to frequently change the IP address associated with their C2 domain. This makes it harder for defenders to block C2 traffic based solely on IP addresses, as the domain can resolve to different IPs over time.”
• [T1566.001] Phishing – Phishing emails used to deliver DarkComet: “Attackers often use phishing emails to trick victims into downloading and executing DarkComet. These emails might contain malicious attachments or links to websites hosting the malware.”
• [T1036] Masquerading – Bundling with legitimate software: “Attackers sometimes bundle DarkComet with legitimate software, especially on unofficial download sites.”
• [T1203] Exploitation for Client Execution – Exploiting vulnerabilities to install DarkComet without user interaction: “Exploiting software vulnerabilities in the victim’s system to install DarkComet without user interaction is another method.”
• [T1105] Ingress Tool Transfer – Downloading additional malware after compromise: “DarkComet can download additional malware to extend functionality, establish persistence, and create botnets.”
• [T1547] Boot or Logon Autostart Execution – Establish Persistence: “Establish Persistence”
• [T1021] Lateral Movement – Spread Laterally within a network: “Spread Laterally”
• [T1486] Data Encrypted for Impact – Conduct specific attacks such as ransomware: “such as ransomware to encrypt files and demand a ransom, spyware to monitor user activities, or wipers to destroy data.”