Iran’s APT34 Using DoH Protocol in Attacks

Read the original article: Iran’s APT34 Using DoH Protocol in Attacks

Oilrig (APT34) have become the first publicly known group to use DNS-over-HTTPS (DoH) protocol as a Command and Control (C2) channel for its malware. According to Vincente Diaz of Kaspersky, the Iranian group was first observed implementing the protocol in May of 2020. The threat group modified the open-source project DNSExfiltrator, which works as a […]

The post Iran’s APT34 Using DoH Protocol in Attacks appeared first on Binary Defense.

Read the original article: Iran’s APT34 Using DoH Protocol in Attacks