Connect with us

News

Decoy Dog is No Ordinary Pupy – Infoblox Reveals Shift in Malware Tactics After Initial Discovery

Published

3 years ago

on

Infoblox Inc., the company that delivers a simplified, cloud- enabled networking and security platform for improved performance and protection, today published a second threat report with critical updates on “Decoy Dog,” the remote access trojan (RAT) toolkit they discovered and disclosed in April 2023. The malware uses DNS to establish command and control (C2) and is suspected as a secret tool used in ongoing nation-state cyberattacks.

The threat actors swiftly responded following Infoblox’s disclosure of the toolkit, adapting their systems to ensure continued operations, indicating that maintaining access to victim devices remains a high priority. The analysis shows that the use of the malware has spread, with at least three actors now operating it. Although based on the open-source RAT Pupy, Decoy Dog is a fundamentally new, previously unknown, malware with many features to persist on a compromised device. Many aspects of Decoy Dog remain a mystery, but all signs point to nation-state hackers. Infoblox released a new data set containing DNS traffic captured from Infoblox’s servers to support further industry investigation of the C2 systems.

The question many in the industry continue to silently ask is:  Are we really securing our network if we’re not monitoring our DNS? There is a significant risk that Decoy Dog and its use will continue to grow and impact organizations globally. Currently, the only known means to detect and defend against Decoy Dog/Pupy today is with DNS Detection and Response systems like Infoblox’s BloxOne® Threat Defense.

“It’s intuitive that DNS should be the first line of defense for organizations to detect and mitigate threats like Decoy Dog. Infoblox is the industry’s best-of-breed DNS Detection and Response solution, providing companies with a turn-key defense that other XDR solutions would miss,” said Scott Harrell, Infoblox President and CEO.  “As demonstrated with Decoy Dog, studying and deeply understanding the attacker’s tactics and techniques allows us to block threats before they are even known as malware.”

Through large-scale DNS analysis, Infoblox has learned key features of the malware and the actors who operate it. Directly following the first announcement on social media, every Decoy Dog threat actor responded to Infoblox’s disclosures in different ways. Some of the name servers mentioned in Infoblox’s April 2023 report were taken down, while others migrated their victims to new servers. Despite their efforts to hide, Infoblox has continued to track the activities and has since learned a great deal more about them. Infoblox has been able to infer the nature of some communications, and estimates that the number of compromised devices is relatively small. Infoblox has also been able to distinguish Decoy Dog from Pupy and determine that Decoy Dog has a full suite of powerful, previously unknown capabilities, including the ability to move victims to another controller, allowing them to maintain communication with compromised machines and remain hidden for long periods of time. Some victims have actively communicated with a Decoy Dog server for over a year.

“The lack of insight into underlying victim systems and vulnerabilities being exploited makes Decoy Dog an ongoing and serious threat,” said Dr. Renée Burton, Head of Threat Intelligence at Infoblox. “The best defense against this malware is DNS. Malicious activity often goes unnoticed because DNS is undervalued as a critical component in the security ecosystem. Only enterprises with a strong protective DNS strategy can protect themselves from these types of hidden threats.”

In total, Infoblox is currently monitoring 20 Decoy Dog domains, some of which were registered and deployed within the last month. This toolkit exploits an inherent weakness of the malware-centric intelligence ecosystem that dominates the security industry today. Furthermore, this malware was discovered solely because of DNS threat detection algorithms. Organizations best defense against these attacks is protection at the DNS level, within every network. Infoblox’s BloxOne® Threat Defense customers remain protected from Decoy Dog and these known malicious threat actors.

“We urge the industry to take this research forward, further investigate and share their findings,” added Harrell.

Hands-On, Real-Life Experience of Pupy at BlackHat: Dr. Renée Burton will be discussing why “Decoy Dog is No Ordinary Pupy” in detail, along with other key findings at Black Hat cybersecurity conference in Las Vegas on Wednesday, August 9 from 1:15 pm-1:35 pm PT. Throughout the conference, attendees will be able to meet with Infoblox researchers and demonstrate their skills with a series of hands-on challenges using a live Pupy controller via Infoblox’s Double Dog Dare experience. Additional short introductions to Decoy Dog and Pupy will be held at the booth theater both days. This unique experience will allow participants to see firsthand how the DNS traffic is used to relay communications between the client and server to better understand the serious threat this malware poses.

The Hidden Potential of DNS in Security: Decoy Dog and Pupy take advantage of the lack of DNS oversight that often occurs in networks. In fact, over 90% of all malware uses DNS in some way. Infoblox knows it’s imperative that security professionals understand the ways in which malware exploits DNS and how DNS Detection and Response can often thwart these attacks. Experts in the field recently released a new book titled “The Hidden Potential of DNS in Security.” This book gives readers everything they need to know about lookalike domains, domain generated algorithms (DGAs), DNS tunneling, data exfiltration over DNS, why hackers use DNS, and how to defend against these attacks.

Related Topics:
Continue Reading

Financial

Dhruva to Rebrand as Ryan Across the Middle East, Signaling Unified Global Brand

Published

2 days ago

on

September 2, 2026

By

Dhruva will adopt the Ryan brand across the UAE and Saudi Arabia by the end of 2026, uniting the practice with Ryan’s global identity and international platform.

Dhruva, a leading tax consultancy firm in the Middle East, and Ryan, a leading global tax services and software provider, today announced that Dhruva will transition to the Ryan brand across the United Arab Emirates (UAE) and the Kingdom of Saudi Arabia. The rebranding will be completed by the end of 2026, bringing the practice under Ryan’s global identity and reinforcing its position as part of the world’s leading global-scale specialist in business tax.

The transition marks the next phase of the strategic joint venture announced in 2025 and reflects the continued integration of Dhruva’s regional capabilities with Ryan’s global platform, technology, and international resources. Clients across the Middle East will continue to benefit from the same trusted advisory teams, enhanced by access to Ryan’s worldwide expertise and service capabilities.


“The Middle East has been a strategic growth market for us for many years, and we have built a strong advisory practice founded on deep client relationships, technical excellence, and local market understanding,” said Dinesh Kanabar, Founder, Chairman, and CEO, Dhruva Advisors and Vice Chairman, Ryan.

“The transition to the Ryan brand marks a significant milestone in our journey and reflects the strength of our partnership. By combining our regional expertise with Ryan’s global scale, technology, and international capabilities, we are creating an even stronger platform to support clients across the region as they navigate an increasingly dynamic and evolving tax landscape.”


“The Middle East is one of the most important growth markets for tax advisory services globally, and we are investing in the region with a long-term view,” said Tom Shave, President of Ryan’s European and Asia-Pacific Operations. “Uniting under the Ryan brand strengthens how we serve clients across the UAE, Saudi Arabia, and Europe—bringing seamless access to our global expertise, technology, and international resources through one trusted platform. This transition marks an important milestone in our integration and reinforces our commitment to the region’s future.”


Ryan will continue to invest in its Middle East operations, expanding its team, capabilities, and regional presence across key markets, including Dubai, Abu Dhabi, and Riyadh. The practice provides comprehensive tax advisory services spanning corporate tax, value-added tax (VAT) and indirect tax, transfer pricing, mergers and acquisitions (M&A) tax structuring, research and development (R&D), and cross-border compliance.


“The response from our clients over the past year has been the clearest validation of this partnership,” said Nimish Goel, Leader, Middle East, Dhruva, a Ryan Affiliate. “From the outset, our teams have been integrating Ryan’s global capabilities in technology, specialized expertise, and best practices into the work we already lead in the region. Adopting the Ryan brand is the natural next step. It is the same people and the same trusted relationships, now carrying the name of the largest Firm in the world dedicated exclusively to business taxes.”


The rebranding will be implemented in phases during the second half of 2026, with signage, visual identity, and digital properties transitioning to the Ryan brand across the region.

Continue Reading

News

GFH Partners Manrre REIT (CEIC) PLC and Palmon Group unveil new temperature-controlled chemical warehouse in JAFZA

Published

8 months ago

on

January 13, 2026

By

GFH Partners Manrre REIT (CEIC) PLC (“Manrre” or “the Fund”), managed by GFH Partners Ltd. (“GFH Partners”),  together with its development manager Palmon Group FZCO (“Palmon Group”), today announced the opening of a specialised temperature-controlled chemical warehouse in Jebel Ali Free Zone (Jafza), further expanding the Fund’s Grade A logistics portfolio.

The inauguration ceremony was held in the presence of Mr Abdulla Bin Damithan, CEO and Managing Director, DP World GC, alongside senior officials and dignitaries from Jebel Ali Free Zone, GFH Partners, and Palmon Group.

Purpose-built and developed by Palmon Group to meet stringent international safety and compliance standards, the new facility reflects the rising regional demand for certified chemical storage infrastructure that supports manufacturing, energy, industrial services, and third-party logistics. The warehouse is situated on a 180,000sq ft plot with a built-up area of 112,000 sq ft, divided into three temperature-controlled chambers that reach a maximum height of 13 metres. The warehouse has been designed with advanced Early Suppression Fast Response (ESFR), and in-rack sprinkler systems to ensure safety and resilience across all operations.

The facility’s layout allows storage of a diverse range of hazard-classified chemicals. One chamber is configured for UN Class 3 and 4 chemicals, a second accommodates UN Class 5 chemicals, while the third has been developed for UN Class 6, 8, 9 and non-regulated materials. The warehouse offers capacity for 17,400 pallets and includes nine loading docks and three loading bays. The office space has been intentionally limited to three percent of the total built-up area, maximising operational efficiency and warehouse utility.

Speaking on the launch, Kunal Lahori, CEO of Palmon Group and Board Member of Manrre, said: “This new facility brings together precision engineering, regulatory compliance, and long-term value creation. Specialised chemical storage requires a high degree of control and risk management, and we have developed this warehouse to meet those expectations while offering flexibility and scalability for tenants. As one of the earliest developers in Jafza, Palmon Group remains committed to supporting the UAE’s logistics and industrial growth.”

Mohamed Ali, Head of GCC at GFH Partners, said: “The opening of this warehouse marks another important milestone in the expansion of the GFH Partners Manrre REIT portfolio, particularly in mission-critical industrial and logistics assets that serve high-growth sectors. The UAE continues to see strong demand for specialised storage solutions, and this facility reinforces our strategy to develop resilient, future-ready assets that deliver long-term value for our investors.”

The logistics hub is now fully operational and is leased to Safe Logistics. The new facility is expected to play a significant role in strengthening regulated supply chains and supporting Dubai’s position as one of the region’s foremost logistics and industrial hubs.

Continue Reading

News

Big Ticket joins DP World ILT20 Season 4 as Official Partner

Published

9 months ago

on

December 20, 2025

By

A professional cricket player for the Desert Vipers in mid-swing during a match. The batsman is wearing a dark green and black patterned jersey with red accents, a red helmet, and black protective leg pads. He is holding a wooden cricket bat high in a follow-through motion after playing a shot. The background shows a crowded stadium with purple and blue seating and a "DP World" branded wicket.

Big Ticket, the largest and longest-running guaranteed raffle draw in the Middle East (known for cash prizes, dream luxury cars, gold bars and coins) has joined the DP World International League T20 Season 4 as an Official Partner.

In recent years, Big Ticket has become more than just a raffle, it has gained the reputation of being a brand built around rewarding dreams and celebrating ambition, growing into one of the region’s largest and one of the most anticipated monthly draws in the UAE.

DP World ILT20 – the 34-match cricketing extravaganza – the biggest T20 tournament in the region featuring some of the most renowned global cricket stars is currently being played at the Dubai International Stadium, Zayed Cricket Stadium, Abu Dhabi and Sharjah Cricket Stadium.

A cricket player from the Abu Dhabi Knight Riders standing at the crease, ready to receive a ball. The player is dressed in a purple and gold uniform with matching gold-colored leg pads and a gold helmet. He holds the bat upward in a standard batting stance. The stadium background features blue seats, a "UAE Cricket" sign, and another player in an orange uniform in the distance.

DP World ILT20 Head of Partnerships Ishan Chopra: “We are delighted to welcome a UAE born raffle giant like Big Ticket as an Official Partner of the DP World ILT20. Their legacy of helping dreams come true aligns perfectly with our vision of delivering unforgettable, fan-first experiences across the league. This partnership strengthens our commitment to creating moments of excitement both on and off the field, and we look forward to elevating Season 4 together. With a household name like Big Ticket on board, we are confident of unlocking even more opportunities for fans to engage, celebrate and go All In for Cricket.”

Meanwhile, DP World ILT20 match tickets across all categories are available for the remaining tournament matches. Various spectator stand tickets start at AED 20 and hospitality packages start from AED 325. Fans can also book the new Sixes Lounge experience for AED 395, which includes unlimited food and beverages. Tickets can be purchased by visiting tickets.ilt20.ae or Virgin Megastores.

Continue Reading

Trending

Copyright © 2023 | The Integrator