Utilizing DNS and ICMP for Data Exfiltration: How MystRodX Steals Sensitive Information from Compromised Systems
A sophisticated new backdoor malware, named MystRodX, has emerged, operating undetected for over 20 months. This malware infiltrates networks through an ingenious dual-mode activation system and was initially discovered masquerading as a variant of Mirai. MystRodX represents a significant evolution in stealth malware design, utilising DNS queries and ICMP packets as covert communication channels to evade traditional security measures. It first surfaced on June 6, 2025, when suspicious activity was detected from IP address 139.84.156.79, distributing an ELF file named dst86.bin. Despite being classified as Mirai by conventional scanners, with only a 4/65 detection rate on VirusTotal, analysts from XLab’s Cyber Threat Insight and Analysis System identified it as a complex C++ backdoor with unprecedented stealth capabilities. MystRodX can remain completely dormant without binding to network ports, making it virtually invisible to standard network monitoring tools.
The malware employs a sophisticated triple-layer encryption strategy, which includes single-byte XOR for VM detection strings, custom transform algorithms for AES keys and trigger packets, and AES CBC mode for configuration data. This multi-tiered approach ensures that sensitive components remain protected even if portions of the malware are discovered. The configuration of MystRodX reveals activation timestamps dating back to January 7, 2024, indicating extensive deployment across compromised systems. Three active command-and-control servers have been identified, with evidence suggesting additional undiscovered campaigns utilising distinct RSA key pairs for different attack operations. MystRodX’s most innovative feature is its DNS-triggered activation system, which transforms seemingly benign DNS queries into sophisticated command vectors. The malware monitors incoming network traffic using raw sockets, analysing DNS requests that follow a specific format, where the domain name contains encoded activation instructions. The activation process begins when the malware encounters a specially crafted DNS query, such as “www.UBw98KzOQyRpoSgk5+ViISKmpC6ubi7vao=.com.” The encoded portion undergoes Base64 decoding, producing a 32-byte ciphertext that contains the activation payload. Using a proprietary transform algorithm with predefined magic values, the malware decrypts this payload to reveal critical operational parameters, including the magic identifier “CAT” and protocol specifications (TCP/HTTP).
Categories: Malware, Stealth Techniques, Command-and-Control Systems
Tags: Backdoor, Malware, MystRodX, DNS, ICMP, Stealth, Encryption, Activation, Command-and-Control, Behavioral Analysis