Msupedge Backdoor Targeting Taiwanese University (Campaign)

Backdoor.Msupedge is a DNS-tunneling backdoor used in an attack against a Taiwanese university, likely leveraging PHP CVE-2024-4577 for remote code execution on Windows. The backdoor installs as DLLs (e.g., wuplog.dll, wmiclnt.dll) and uses a dnscat2-based DNS channel to receive commands encoded in DNS queries and TXT records; it alters behavior based on the third octet of resolved IP addresses and supports actions such as creating processes, downloading files, and returning execution results.