Researchers Crack Mad Max Botnet DGA Algorithm and See in the Future

Arbor Networks researchers have reverse-engineered the domain generation algorithm (DGA) used by the Mad Max malware to connect to its botnet, which now allows them to put counter-measures in place to prevent infection and sinkhole its operations. Mad Max is a new malware spotted for the first time earlier this year. Little research exists on this malware, outside of a mention from UK security firm Sophos. Based on its analysis, Arbor Networks defines Mad Max as a "targeted trojan," a definition that implies usage in targeted attacks, usually for cyber-espionage, industrial espionage, or other hacking operations specific to very sophisticated threat actors. Mad Max uses a different C&C server each week Arbor discovered that like most modern malware, Mad Max connects to a C&C server to communicate with its masters. Like most advanced malware, the address of this C&C server is not hard-coded in its source but generated automatically based on a DGA,...