ZLoader Malware Resurfaces Using DNS Tunneling for C2 Comms

Title: New ZLoader Malware Version Enhances Evading Tactics with DNS Tunneling

Cybersecurity experts have identified a new iteration of the ZLoader malware, now utilizing a Domain Name System (DNS) tunnel for its command-and-control (C2) communications. This development underscores the ongoing efforts by threat actors to refine their tools, particularly since ZLoader resurfaced just over a year ago. ZLoader 2.9.4.0 introduces significant upgrades, including a custom DNS tunnel protocol and an interactive shell that supports a wide array of commands, making it increasingly effective for potential ransomware attacks.

Key Features of the Latest ZLoader Malware Version

ZLoader, also known as Terdot, DELoader, or Silent Night, is a sophisticated malware loader capable of deploying subsequent payloads. After nearly two years of inactivity, malware campaigns linked to ZLoader were observed again in September 2023, following the dismantling of its infrastructure. Below are some key features of the latest version:

• Custom DNS Tunnel Protocol: Enhances C2 communications, providing an additional layer of resilience against detection.
• Interactive Shell: Allows operators to execute arbitrary binaries, DLLs, and shellcode, exfiltrate data, and terminate processes.
• Advanced Evasion Techniques: Utilizes a domain generation algorithm (DGA) and checks to prevent execution on differing hosts, a technique reminiscent of the Zeus banking trojan.

Ransomware Connection and Evolving Distribution Methods

Recent trends show a growing association between ZLoader and Black Basta ransomware attacks. Threat actors often deploy this malware through remote desktop connections disguised as tech support solutions. Zscaler ThreatLabz has noted the discovery of an additional component in the attack chain, involving a payload named GhostSocks, which precedes the deployment of ZLoader.

The report highlighted that ZLoader’s anti-analysis techniques, like environment checks and API import resolution algorithms, are consistently updated to bypass malware sandboxes and static signatures.

Increasing Focus on Evasion and Security

The latest ZLoader version maintains HTTPS with POST requests as its primary C2 communication channel while integrating DNS tunneling to encrypt TLS network traffic via DNS packets. Zscaler emphasized that these distribution methods and the new DNS tunneling feature indicate a concerted effort by the threat group to enhance evasion tactics.

Conclusion: Heightened Vigilance Required

As ZLoader continues to evolve, cybersecurity measures must adapt to counteract these sophisticated threats. Organizations should be vigilant and implement robust security protocols to safeguard against such malware attacks.

Have any thoughts on the latest ZLoader developments? Share your insights in the comments below, and for more related articles, follow us on Twitter and LinkedIn!

For additional information on cybersecurity threats, visit Zscaler’s ThreatLabz and CISA’s Cybersecurity Resources.