"Decoy Dog" Malware Toolkit Unveiled in Analysis of DNS Records

A new malware toolkit named Decoy Dog has been discovered, which is targeting enterprise networks. The toolkit employs techniques such as strategic domain aging and DNS query dribbling, where a series of queries are sent to the command-and-control domains to avoid suspicion. Decoy Dog is described as a cohesive toolkit with distinct characteristics that make it unique and identifiable, particularly when examining its domains on a DNS level. The malware was discovered in April 2023 following anomalous DNS beaconing activity, and its atypical characteristics allowed it to map additional domains that are part of the attack infrastructure.