APT34 Employs DoH in Recent Attacks

Summary

An Iranian advanced persistent threat (APT) group, known as APT34 or OilRig, is employing the DNS-over-HTTPS (DoH) protocol via the DNSExfiltrator open-source project in recent attacks. DNSExfiltrator creates covert communication channels and uses traditional and DoH requests to exfiltrate data from compromised networks by hiding it in non-standard protocols. This technique is used to evade detection and monitoring during the exfiltration process.

Recommendations

The NJCCIC recommends those whose networks may be considered high-value targets for APT activity ensure they implement a defense-in-depth cybersecurity strategy that includes following the principle of least privilege, utilizing intrusion detection and prevention technologies, running an endpoint detection and response program, keeping hardware and software patched with the latest updates, and establishing a comprehensive data backup plan. For more information on APT34’s use of DoH in recent incidents, review the ZDNet article.