SYMBOLCOMMON_NAMEaka. SYNONYMS
win.lyceum_dns_backdoor_dotnet (Back to overview)

Lyceum .NET DNS Backdoor

Actor(s): LYCEUM

This .NET written malware is used as backdoor using the dns protocol by a state sponsored threat actor. It implements additional capabilities (e.g. execution of commands, taking screenshots, listing diles/directories/installed applications, and uploading/downloading/execution of files). There are also variants using HTTP (.Net) and also one written in Golang.

References
2022-06-09 ⋅ Zscaler ⋅ Niraj Shivtarkar, Avinash Kumar
@online{shivtarkar:20220609:lyceum:20cd217, author = {Niraj Shivtarkar and Avinash Kumar}, title = {{Lyceum .NET DNS Backdoor}}, date = {2022-06-09}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor}, language = {English}, urldate = {2022-06-10} } Lyceum .NET DNS Backdoor
Lyceum .NET DNS Backdoor
2022-03-31 ⋅ Check Point Research
@online{research:20220331:statesponsored:d8ce198, author = {Check Point Research}, title = {{State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage}}, date = {2022-03-31}, url = {https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/}, language = {English}, urldate = {2022-04-05} } State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage
Loki RAT El Machete APT Backdoor Dropper Lyceum .NET DNS Backdoor Lyceum .NET TCP Backdoor Lyceum Golang HTTP Backdoor

There is no Yara-Signature yet.