Botnets abuse .bit domains via OpenNIC
Cybercriminals are using decentralized .bit domains and OpenNIC DNS resolvers to run bulletproof botnet C&C infrastructure that resists takedown.
Sourceabuse.ch — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Abuse.ch details how botnet operators are increasingly leveraging the Namecoin-based .bit top-level domain to host Command & Control infrastructure. Because .bit is decentralized and not governed by ICANN, domain names cannot be seized, suspended, or sinkholed by researchers or law enforcement, and registrant information is entirely anonymous. As a result, malicious .bit domains have been observed remaining active for many months longer than typical botnet C&C domains hosted on conventional TLDs, offering a form of bulletproof hosting.
Since .bit is not resolvable through the standard DNS root, malware relies on the OpenNIC alternative DNS project (hardcoded server lists) to resolve .bit C&C domains, with resolution often delegated to third-party DNS providers such as dnspod.com. Testing of 52 OpenNIC DNS servers found only 8 (15%) applied abuse-based filtering, meaning most malware traffic to .bit-based C&C successfully resolves. The example campaign analyzed used the Chthonic banking trojan (a ZeuS derivative) delivered via the RIG exploit kit, with a C&C domain (pationare.bit) that had remained live for roughly nine months. The author notes this technique is not limited to Chthonic and has also been observed in Smoke Loader/Dofoil, a TeamViewer backdoor, Necurs, Shifu, and TinyNuke, and recommends organizations block OpenNIC DNS servers at the firewall to disrupt resolution of such malicious domains.
Mentioned in this report
Detection guidance
Process Using OpenNIC DNS for Name Resolution
A behavioural hunt for the technique in general.
Processes configuring or querying via OpenNIC DNS servers (via hardcoded resolver lists or registry/configuration), enabling dynamic resolution of .bit C&C domains. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Using OpenNIC DNS for Name Resolution
description: Detects process execution or network connections using hardcoded OpenNIC
DNS server addresses for name resolution, a technique used by botnet malware to
dynamically resolve .bit-based C&C infrastructure that evades traditional DNS sinkholing.
tags:
- attack.command-and-control
- attack.t1568
- attack.t1071.004
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 185.121.177.153
- 169.239.202.202
- 185.107.47.215
- 188.226.146.136
- 195.154.109.33
- 198.51.100.250
- 209.141.36.60
- 216.87.84.211
filter_legitimate:
Image|endswith:
- \nslookup.exe
- \dig.exe
condition: selection and not filter_legitimate
falsepositives:
- IT administrators testing OpenNIC connectivity or .bit domain resolution
- Configuration management tools deploying alternative DNS settings
level: medium
id: a2b92c70-b39f-53ec-b7f7-937f6054dfa9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://abuse.ch/blog/dot-bit-the-next-generation-of-bulletproof-hosting
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs