New Wekby Attacks Use DNS Requests As Command and Control Mechanism - Palo Alto Networks BlogPalo Alto Networks Blog

This Unit 42 technical blog post documents Wekby APT activity targeting a U.S. organization using a malware family dubbed "pisloader" — a heavily obfuscated payload delivered via an HTTP dropper that establishes persistence and uses DNS TXT queries for C2 (with base32-encoded payloads and strict DNS flag checks); the report includes dynamic and static analysis details, supported commands, ROP-based obfuscation, associated domains/IPs and file hashes, and recommended protections (WildFire detection, AutoFocus tagging, IPS rules).