Historically associated with credential theft and USB-based propagation, the malware now utilizes Microsoft’s infrastructure to evade traditional network defenses by masquerading as legitimate developer activity. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Microsoft Dev Tunnels, designed to expose local services via temporary HTTPS URLs for debugging purposes5, is being weaponized to host Njrat’s C2 servers. By routing traffic through Microsoft’s trusted domains (devtunnels.ms), attackers bypass IP/DNS reputation checks and leverage TLS encryption to obscure payloads. Defenders face visibility gaps, as Dev Tunnels traffic resembles legitimate developer activity. The threat remains active as of February 28, 2025, with infrastructure linked to historical Njrat campaigns in the Middle East and North Africa. Network telemetry showing prolonged connections to *.devtunnels.ms or processes like devtunnel.exe paired with unsigned binaries may indicate abuse. Security teams are advised to correlate these IOCs with DNS logs and endpoint process trees. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 28 Feb 2025 12:15:02 +0000