MystRodX: Weaponizing DNS and ICMP for Data Theft

MystRodX is described as a sophisticated backdoor that exploits DNS and ICMP to activate and exfiltrate data from compromised systems, deployed via a dropper masquerading as a Mirai variant and remaining undetected for over 20 months. In passive mode the malware binds to no open ports and instead monitors all incoming traffic on a raw socket, providing stealthy operation.

Activation occurs only when a specially crafted DNS query or ICMP packet containing an encrypted payload is received; after decoding and a transform algorithm, the payload reveals four fields—Magic, Protocol, Port, and C2 IP—and triggers a connection to the attacker’s command server.

The article notes that a DNS trigger packet follows the format www.DomainName[.]com, with the DomainNam segment being a Base64-encoded, multi-layer XOR-encrypted string, leading to a plaintext packet that instructs the backdoor to use TCP on port 8010 and to contact C2 149.28.137[.]254; ICMP wakeups target 192.168.96[.]1 on port 443.

Three live command servers were identified—149.28.137[.]254, 156.244.6[.]68, and 185.22.153[.]228—with only the first decrypting with keys tied to the “neybquno” campaign, suggesting additional undetected samples in the wild.