Malware

DnsSystem

DnsSystem is a Windows malware family associated with command-and-control communications, host identification, and data theft. It has been observed using the current Windows username to derive a unique identifier for infected users and systems, indicating victim profiling and host tracking functionality. The malware can exfiltrate collected data to its command-and-control infrastructure and supports file upload from compromised machines on operator command. Its network communications may include Base64 encoding of data sent to command and control, consistent with basic traffic obfuscation. DnsSystem has also been delivered through social-engineering lures involving macro-enabled Microsoft Word documents, requiring user interaction to trigger execution. The documented behavior supports classification as a backdoor-oriented malware family used for post-compromise collection and remote tasking on Windows hosts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059.003Windows Command ShellEvidence3

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

T1059.007JavaScriptEvidence1

The content repeatedly mentions malicious macros in Word/Excel documents, such as "enable macros," "embedded macros," and "macro-enabled documents."

T1204User ExecutionEvidence1

The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.

T1204.002Malicious FileEvidence2

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence5

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence5

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence5

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

Collection

1 technique

T1005Data from Local SystemEvidence1

Command and Control

4 techniques

T1071.004DNSEvidence1

T1105Ingress Tool TransferEvidence1

T1132Data EncodingEvidence2

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence5

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

12 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that uses the Windows username to create a unique identifier for infected users and systems.

mitre attack websiteNews

Nov 19, 2019

User Execution: Malicious File, Sub-technique T1204.002 - Enterprise | MITRE ATT&CK®

Malware executed through macro-enabled Word documents.

mitre attack websiteNews

Mar 8, 2018

Data Encoding: Standard Encoding, Sub-technique T1132.001 - Enterprise | MITRE ATT&CK®

Malware that can Base64-encode data sent to command-and-control infrastructure.

mitre attack websiteNews

Mar 8, 2018

Data Encoding: Standard Encoding, Sub-technique T1132.001 - Enterprise | MITRE ATT&CK®

Malware that can Base64-encode data sent to command-and-control infrastructure.

+8 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DnsSystem