DnsSystem | Netskope Threat Labs

Description

DnsSystem is a .NET based DNS backdoor, a customized version of the open source DIG.net tool, that the HEXANE threat actor has used since at least June 2022. Its DNS based channel hides command and control traffic inside ordinary name resolution.

Stats

First seen: April 2023
Last seen: October 2026

MITRE ATT&CK techniques

9 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0007 Discovery

T1033System Owner/User Discovery

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.004DNS
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G1001HEXANE

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.DnsSystem	ATP Sandbox Adv. Heuristics
Generic.DnsSystem.A.37211CA2	AV

Related families

KONNI Latrodectus QakBot TrickBot Bisonal

References

attack.mitre.org