+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: RATs: DNS stole all my slaves by pointing DNS to some other IP... WTF ?? (/showthread.php?tid=5503532)
* - Megabear - Dec 25, 2016
Now this defo does not sound great OP..
take your hdd and destroy it lol.
* - yotoprules - Dec 25, 2016
Remove any traces of the RAT, delete your VPS account, do a full format of your hard drives to make sure.
* - QU⚡CKSILVER - Dec 25, 2016
This is the exact same thing DuckDNS did, but with a twist... Your particular domain was reported as malicious and Dynu was warned about it... Dynu Administrators pointed that domain to one of their endpoints to analyze the traffic coming in. They found out about your domain being used for a botnet, then pointed it back to your original IP address...
Slaves should still connect, unless they managed to uninstall them all for you by using the exact same RAT you're using (which is very unlikely to happen). What a DNS provider would've done is to simply suspend the domain, so that it becomes unresolvable... Just like DuckDNS did to all of us.
* - Iraqian - Dec 26, 2016
Very interesting!!!
Frontier com is telecommunications and Internet service provider. I work with them most of the time on priv8 duties. That's a real deal as it reached their HQ DPT. I hope you get out if this deal safely. Good luck.
* - CichyCichoCiemny - Dec 26, 2016
Well, crypt your drives.
🤝
* - Sheeple - Dec 26, 2016
(Dec 26, 2016 02:20 PM)CichyCichoCiemny Wrote: Well, crypt your drives.
🤝
encrypting hdds would do nothing, they need to be wiped/destroyed if he's actually going to be in trouble.
* - Maxie - Dec 26, 2016
Don't crypt your drives. You want to totally format them; writing all 0s to the harddrive. Google for tools.
* - Avira - Dec 26, 2016
well this thread is bullshit, however, even if it is legit For someone to steal your domain reg account and point it to their own Ip for however long proves nothing, if they wanted you to have no bots they would've kept the domain pointed to their own server anyway
Also, they would have to know exactly what rat you're using otherwise there would be no way for him to issue commands to the infected machines. how about a name? (Of the "researcher")
* - Katarina Du Couteau - Dec 26, 2016
You are 100% fucked, someone is dedicated in finding you.
RiP
* - Nickname. - Dec 26, 2016
Well I am sure you got nothing to worry about since the feds wouldnt take your slaves they rather catch you when you maintain your clients.
* - cashf - Dec 29, 2016
Just as update:
- All looks pretty safe still (I don't want to elaborate details here, what exactly I did to prevent that the VPS company can get any info about myself, just I think that is was "enough")
- Nothing has been done with the vics. Setup was for a test only.
- VPS suspended my server couple days before. I realized that the RAT connected to the VPS-IP directly. This made the company suspend my VPS. The reason behind this was, that spamhaus listed my VPS IP as C&C server in a blacklist. Obviously they had send an abuse letter to my VPS company which caused them to take down my VPS.
- Disk of the VPS was completely overwritten at this time. Still VPS company took it down due to spamhaus abuse letter. VPS wasn't a bulletproof one.
- Also DNS and a Domain which I used got suspended.
Pretty harsh reaction, I know, anyway I think that the setup was relatively safe.
I think this can be closed now.
Have a great day!
* - QU⚡CKSILVER - Dec 30, 2016
So Dynu suspended your domain as well?
* - cashf - Dec 30, 2016
(Dec 30, 2016 07:14 AM)QU⚡CKSILVER Wrote: So Dynu suspended your domain as well?
Actually not, dynu was/is still standing. But 2 other backup DNS from alternative DNS providers had been gone. Also the VPS got suspended.
Dynu pointed the domain back to my original IP and dynu WAS and IS the last piece in this whole setup that is still standing. Now worthless of course.
Well... strange story, I will not use this dynu DNS from now on...
* - JoshuTee - Dec 30, 2016
Especially when this looks safe, it's best for your safety to uninstall all your clients and nuke your hard drive with DBAN.
It's frankly quite possible that your will get raided. A friend of mine was in a simulator situation and he DID in fact get raided
* - Armada - Dec 30, 2016
Really 3 pages for this?
@OP, your DNS got flagged and they null routed it to a honeypot.
Simple as that.