Novel Decoy Dog malware toolkit examined

TechRepublic reports that the new Decoy Dog malware toolkit with the Pupy remote access trojan has been discovered by the Infoblox Threat Intelligence Group to be controlling a data exfiltration command-and-control server undetected since last April. Fewer than 3% of all networks were found to have the Decoy Dog toolkit with Pupy, and only 18 domains have been associated with the toolkit, while most of the toolkit's C2 has been hosted in Russia, said the Infoblox report. "One of the main dangers is nobody knows what it is. That means something is compromised and someone controls it, and nobody knows what that is. That's very unusual. We know what the signature is, but we do not know what it is controlling and nobody here does," said Infoblox Senior Director of Threat Intelligence Renee Burton, who also emphasized the association of the complex Pupy trojan with nation-state threat operations.