In the case of just one or two samples, without temporal overlap, this may not be deemed a strong link to CONFUCIUS_A, however it occurs across a great deal of the infrastructure we have observed. Specifically, the command and control addresses used across multiple SNEEPY samples were being used by CONFUCIUS_A samples. Although many of the attacks we see today from the group remain the same, we began observing a new backdoor, CONFUCIUS_A, being dropped by the attackers starting in early 2014. For a long time after the report was published, little changed in how the attackers operated. In 2013, Rapid7 reported on a series of relatively amateur attacks against Pakistani targets.

Confucius says… resolve your command and control domains using web services. The first of which we call ‘CONFUCIUS_A’, a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY (aka ByeByeShell) first reported by Rapid7 in 2013. The second of which we call ‘CONFUCIUS_B’, which has a loose link to the series of attacks associated with Operation Patchwork and The Hangover Report.

This blog post examines two similar malware families that utilize the aforementioned technique to abuse legitimate websites, their connections to each other, and their connections to known espionage campaigns. For attackers, that's an advantage because it allows their initial communications channel to be obscured amongst other traffic to legitimate services.

This negates the requirement to make DNS requests for domains that may be considered malicious and are therefore blocked. In order to increase the likelihood of their malware successfully communicating home, cyber espionage threat actors are increasingly abusing legitimate web services, in lieu of DNS lookups to retrieve a command and control address. When malware wants to communicate home, most use domain names, allowing them to resolve host names to IP addresses of their servers.

How to convert rar files yahoo answers