Botnets abuse .bit domains via OpenNIC

25 September 2017 medium threat

Cybercriminals are using decentralized .bit domains and OpenNIC DNS resolvers to run bulletproof botnet C&C infrastructure that resists takedown.

Abuse.ch details how botnet operators are increasingly leveraging the Namecoin-based .bit top-level domain to host Command & Control infrastructure. Because .bit is decentralized and not governed by ICANN, domain names cannot be seized, suspended, or sinkholed by researchers or law enforcement, and registrant information is entirely anonymous. As a result, malicious .bit domains have been observed remaining active for many months longer than typical botnet C&C domains hosted on conventional TLDs, offering a form of bulletproof hosting.

Since .bit is not resolvable through the standard DNS root, malware relies on the OpenNIC alternative DNS project (hardcoded server lists) to resolve .bit C&C domains, with resolution often delegated to third-party DNS providers such as dnspod.com. Testing of 52 OpenNIC DNS servers found only 8 (15%) applied abuse-based filtering, meaning most malware traffic to .bit-based C&C successfully resolves. The example campaign analyzed used the Chthonic banking trojan (a ZeuS derivative) delivered via the RIG exploit kit, with a C&C domain (pationare.bit) that had remained live for roughly nine months. The author notes this technique is not limited to Chthonic and has also been observed in Smoke Loader/Dofoil, a TeamViewer backdoor, Necurs, Shifu, and TinyNuke, and recommends organizations block OpenNIC DNS servers at the firewall to disrupt resolution of such malicious domains.

Mentioned in this report

Malware Backdoor.TeamviewerChthonicNecursRIG Exploit KitShifuSmoke LoaderTinyNuke

Detection guidance

Process Using OpenNIC DNS for Name Resolution

ATT&CK T1568

Processes configuring or querying via OpenNIC DNS servers (via hardcoded resolver lists or registry/configuration), enabling dynamic resolution of .bit C&C domains. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Using OpenNIC DNS for Name Resolution
description: Detects process execution or network connections using hardcoded OpenNIC
  DNS server addresses for name resolution, a technique used by botnet malware to
  dynamically resolve .bit-based C&C infrastructure that evades traditional DNS sinkholing.
tags:
- attack.command-and-control
- attack.t1568
- attack.t1071.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
    - 185.121.177.153
    - 169.239.202.202
    - 185.107.47.215
    - 188.226.146.136
    - 195.154.109.33
    - 198.51.100.250
    - 209.141.36.60
    - 216.87.84.211
  filter_legitimate:
    Image|endswith:
    - \nslookup.exe
    - \dig.exe
  condition: selection and not filter_legitimate
falsepositives:
- IT administrators testing OpenNIC connectivity or .bit domain resolution
- Configuration management tools deploying alternative DNS settings
level: medium
id: a2b92c70-b39f-53ec-b7f7-937f6054dfa9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://abuse.ch/blog/dot-bit-the-next-generation-of-bulletproof-hosting

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free