Not sleeping anymore: SOMNIRECORD's wake-up call

**Executive summary:** Elastic Security Labs identified and analyzed SOMNIRECORD, a C++ backdoor used by REF2924 that uses DNS TXT records to poll for commands and exfiltrate hex-encoded results (via subdomains like XXX-DATA-...), supports commands for system enumeration, process listing, executing programs, changing beacon intervals, and deploying an ASPX webshell, and includes a hardcoded domain (dafadfweer.top) and a provided YARA signature; the malware appears adapted from the open-source DNS-Persist project.