New Webky Attacks Use DNS Requests as C&C

Palo Alto Networks analyzes a Wekby APT campaign deploying 'pisloader', a DNS TXT-based command-and-control backdoor delivered via HTTP dropper. The report details sample metadata, obfuscation/ROP techniques, supported commands (sifo, drive, list, upload, open), examples of DNS beaconing and responses, and provides IOCs (domains, IPs, SHA256 hashes) along with detection and mitigation measures.