DNS Spoofing or poisoning is a type of cyber-attack that exploits system vulnerabilities in the domain name server to divert traffic away from legitimate servers and directs it towards fake ones
The malicious app poses a legitimate Chrome or Facebook app and it is distributed through fake by pushing a notification to a victim device.
According to TrendMicro analysis report “this new wave of network attacks since early March which for now are targeting Japan, Korea, China, Taiwan, and Hong Kong.
It is also capable of hijacking the device and establish persistence through administrator privileges.
How the Infection Work with DNS Spoofing
Attackers compromise the router settings and redirect the traffic to certain websites and fake drive users to the malicious domains and to download XLoader.
Once the application triggered it hides from the application list and keeps running in the background and triggers the malicious activities.
Trend Micro Researcher says “XLoader creates a provisional web server to receive the broadcast events. It can also create a simple HTTP server on the infected device to deceive victims. It shows a web phishing page whenever the affected device receives a broadcast event (i.e., if a new package is installed or if the device’s screen is on) to steal personal data, such as those keyed in for banking apps”.
The Phishing page translated to Korean, Japanese, Chinese, or English based on the device language that setup in the device. It is capable of collecting SMS details, records phone calls, steals personal and financial data from the device.
XLoader abuses WebSocket protocol over SSL/TLS to establish persistent and secure communication with C&C server, it also abuses message pack to steal the exfiltrated the data faster.
Setup complex password to routers.
Regularly update the Router & Firewall Firmware.
Monitoring the router’s DNS setting at regular intervals.
Stay wise against social engineering attacks.