Did Subdomain Abuse by BlackTech “Evolve”?
summary
Analysis shows BlackTech stops using Dynamic DNS in 2018, registers new parent domains yearly since 2019, and by September 2023 reuses parent domains across multiple targets; IOCs come from ThreatVision/Ti5 and flash reports (Jan 2022–Mar 2024) and investigations use passive DNS plus WHO and IP geolocation. One campaign (DePrint) maps no A record then later maps Amazon/Google IPs (a fake-domain trick). A prototype additional active DNS check that queries parent domains flags many fake responses; strategic reuse improves infrastructure efficiency but does not primarily aim to evade detection.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:59BlackTech threat profile
- 6:12Analysis challenges of BlackTech malware
- 7:18Research goals
- 8:48Time-based change detection
- 10:15Subdomain abuse strategies
- 13:29DNS abuse trends in APT groups
- 15:40Dynamic DNS service abuse
- 16:24Subdomain string abuse and reuse
- 17:31Single vs multiple target reuse
- 19:52Aged and fake domains
- 23:30Countermeasures against fake domains
- 26:04Change detection results
- 28:12Difference detection method
- 32:55APT group operations
- 33:37BlackTech’s parent domain reuse
- 36:09Did BlackTech evolve?
- 39:23Strategic changes vs evasion
- 40:05Conclusion and key takeaways
related talks
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
47mDNS On Fire
32mSomething’s Phishy: See the Hook Before the Bait
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
28mFerris Bueller's Guide to Abuse Domain Permutations
25mDark Side of the DNS Force
22mAPT Attribution and DNS Profiling
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...