Botnets abuse .bit domains via OpenNIC

Cybercriminals are using decentralized .bit domains and OpenNIC DNS resolvers to run bulletproof botnet C&C infrastructure that resists takedown.

Abuse.ch details how botnet operators are increasingly leveraging the Namecoin-based .bit top-level domain to host Command & Control infrastructure. Because .bit is decentralized and not governed by ICANN, domain names cannot be seized, suspended, or sinkholed by researchers or law enforcement, and registrant information is entirely anonymous. As a result, malicious .bit domains have been observed remaining active for many months longer than typical botnet C&C domains hosted on conventional TLDs, offering a form of bulletproof hosting.

Since .bit is not resolvable through the standard DNS root, malware relies on the OpenNIC alternative DNS project (hardcoded server lists) to resolve .bit C&C domains, with resolution often delegated to third-party DNS providers such as dnspod.com. Testing of 52 OpenNIC DNS servers found only 8 (15%) applied abuse-based filtering, meaning most malware traffic to .bit-based C&C successfully resolves. The example campaign analyzed used the Chthonic banking trojan (a ZeuS derivative) delivered via the RIG exploit kit, with a C&C domain (pationare.bit) that had remained live for roughly nine months. The author notes this technique is not limited to Chthonic and has also been observed in Smoke Loader/Dofoil, a TeamViewer backdoor, Necurs, Shifu, and TinyNuke, and recommends organizations block OpenNIC DNS servers at the firewall to disrupt resolution of such malicious domains.

Source reporting: https://abuse.ch/blog/dot-bit-the-next-generation-of-bulletproof-hosting