Muddling Meerkat APT Discovered Pulling DNS Tricks
A new cyber threat named Muddling Meerkat has been detected engaging in sophisticated activities involving the domain name system (DNS) since October 2019. This appears to be an attempt to evade security measures and conduct network reconnaissance globally.
Infoblox, a cloud security firm, suggests that the threat actor is likely associated with the People's Republic of China (PRC) and may have control over the Great Firewall (GFW), which manages internet traffic in and out of China.
The name "Muddling Meerkat" refers to the puzzling nature of their activities, particularly their misuse of DNS open resolvers—DNS servers that accept queries from any IP address—by sending queries from Chinese IP addresses.
According to a report shared with news outlet The Hacker News, Infoblox noted that Muddling Meerkat demonstrates a deep understanding of DNS, which is unusual among threat actors, highlighting DNS as a potent tool for adversaries.
How Muddling Meerkat Tampers With DNS
The threat involves initiating DNS queries, including for mail exchange (MX) records, to domains not owned by the actor but residing under common top-level domains such as .com and .org.
Infoblox discovered this threat by observing anomalous DNS MX record requests from customer devices. They detected over 20 such domains, none owned by Muddling Meerkat.
Dr. Renée Burton from Infoblox stated that Muddling Meerkat must have a relationship with the GFW to generate fake DNS MX records, a behavior not previously observed.
The GFW, which employs DNS spoofing and tampering, injects fake DNS responses for blocked queries. Muddling Meerkat's unique feature is the false MX record responses from Chinese IP addresses, differing from typical GFW behavior.
The motive behind Muddling Meerkat's activities remains unclear, though it may involve internet mapping or research.
Burton emphasized that Muddling Meerkat represents a sophisticated Chinese nation-state actor conducting deliberate DNS operations against global networks, raising concerns due to the unclear full extent of their operations.
Overall, Muddling Meerkat's activities pose challenges different from typical malware operations, warranting continued vigilance and investigation by cybersecurity agencies.
