As cited
Copy frozen at (site build).
threat intel
Not sleeping anymore: SOMNIRECORD's wake-up call
Elastic Security Labs researchers identified SOMNIRECORD, a new C++ backdoor malware that disguises its command and control (C2) communications as DNS traffic. The malware establishes persistent remote access to infected systems while evading detection through protocol obfuscation.
Why it matters: Organizations running systems in Elastic environments should hunt for DNS anomalies and C2 beaconing patterns to detect SOMNIRECORD infections before attackers establish persistence.
- Source published
- First seen by Cybersecurity Tracker