Share on LinkedInShare on LinkedIn

ARTICLE · 03 MAY 2023

Ankura CTIX FLASH Update - April 18, 2023

Researchers have observed a new backdoor dubbed "Domino" that they believe was likely developed by the FIN7 Russian cybercriminal group and is being utilized by former Conti affiliate...

United StatesTechnology

Malware Activity

New Domino Backdoor Suspected to be a Collaboration Between Former Conti Members and FIN7

Researchers have observed a new backdoor dubbed "Domino" that they believe was likely developed by the FIN7 Russian cybercriminal group and is being utilized by former Conti affiliates since at least February 2023. This belief is due to code overlaps between Domino Backdoor and the "Lizar" malware family (also known as "Tirion" and "Diceloader"), which is linked to FIN7. Lizar is known to collect sensitive information from "clipboard, Discord, web browsers, crypto wallets, VPN services, and other apps." Domino's focus is to obtain victims' system information and send the data to its command-and-control (C2) server, where an AES encrypted payload is sent in return. Researchers emphasized that the returned payload, named "Domino Loader," is a second payload that has coded overlaps with Domino Backdoor. Domino is currently being used to deliver "either the

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from