No Time to Spy: Uncovering Domains Distributing SpyNote Malware

No Time to Spy: Uncovering Domains Distributing SpyNote Malware

Speakers: Dana Schwabby, Head of Investigations & CISO, DomainTools

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=LOLhCboYDXQ

Overview

Dana Schwabby, Head of Investigations and CISO at DomainTools, delivered a detailed walkthrough of how the SpyNote Android remote access Trojan (RAT) is distributed through fake Google Play Store pages and how passive DNS analysis can unravel the attacker infrastructure behind it. With 25 years of experience spanning state and federal government, higher education at the University of Washington, and a decade in private industry, Schwabby brings a practitioner's eye to threat hunting.

The talk is anchored in original research published by the DomainTools Investigations (DTI) team, which deliberately infected devices with SpyNote, sandboxed the malware, and then mapped the command-and-control infrastructure using passive DNS pivots. The result is a practical masterclass in how DNS telemetry transforms a single indicator of compromise into a map of an adversary's entire operational footprint.

SpyNote matters because it is actively wielded by nation-state APT groups including APT34 (OilRig), APT-C-37 (PatchBear / Syrian Electronic Army), and OilAlpha (pro-Houthi), targeting dissidents, humanitarian organizations, and media outlets. Understanding its distribution and C2 mechanics is directly actionable for defenders.

Background

▶ Watch: Introduction and the DomainTools Investigations program (0:00)

SpyNote has been evolving for roughly a decade. It first surfaced around 2016 as a leaked .NET tool with associated APKs. The malware took a significant turn around 2021 when the developer known as EVLF (also called CipherRat) pivoted it toward banking fraud. SpyNote was historically sold as malware-as-a-service through Telegram channels, and source code leaks have produced multiple forks over the years.

The current generation of SpyNote is sophisticated: it persists through device reboots, records screens and audio, activates cameras, steals 2FA codes in real time from apps like Google Authenticator, and uses Android accessibility features for keylogging. Delivery relies on social engineering through fake Google Play Store pages that clone legitimate CSS and HTML, tricking users into sideloading malicious APKs.

Schwabby also contextualized DomainTools' broader mission through their DTI program, which publishes product-agnostic threat research weekly. Their three-part series on the Great Firewall of China was cited as an example of community-first publishing that drives credibility without vendor pitching.

Key Findings

▶ Watch: Fake Google Play Store delivery sites and APT attribution (10:00)

The DTI team identified several dozen fake Google Play Store sites distributing SpyNote. Sandbox analysis of the malware and its delivery infrastructure revealed consistent patterns:

• Registrars: Delivery domains favored Silo and Zet Technology as registrars.
• Hosting: Preferred providers were Vultr and LightNode, both well-known in threat hunting circles.
• TLS Certificates: All delivery domains used Let's Encrypt with R10 or R11 certificate versions.
• Name Servers: Consistently used DNS Owl and Zinc Cache (related to the Zet Technology registrar).
• C2 IPs: A small number of prominent IP addresses served as command-and-control endpoints.

A critical operational finding was the shift from newly registered domains (NRDs) to newly active domains (NADs). Threat actors are increasingly re-registering expired domains that carry residual trust and age, bypassing heuristic detection that flags young domains. DomainTools detects new domain registrations within approximately five minutes and tracks full domain lifecycle data going back to 2010.

The team also discovered that SpyNote's C2 logic dynamically pre-calculates which domains to reach out to, using a DEX file with methods to select from a predefined list. The malware can be updated on the fly once a C2 connection is established, allowing operators to push new domain lists without re-deploying the malware itself.

Technical Deep Dive

▶ Watch: Anatomy of the multi-stage dropper and C2 domain selection logic (20:00)

The malware delivery chain is multi-stage. The fake Google Play Store page contains an install button that triggers a hidden iframe loading a JavaScript URI. This initiates download of a fake Chrome APK that serves as the first-stage dropper. Android's built-in security prompts are bypassed through social engineering, with fake popups claiming Google needs additional data.

Once the user confirms, the dropper pulls a second, encrypted APK. The decryption key is generated on the fly from the manifest file through a calculation process. After decryption, the actual SpyNote payload is installed, loads its components, and establishes a connection to the C2 server.

The bulk of the technical talk focused on passive DNS as an investigative tool. Unlike active DNS lookups, which can alert sophisticated threat actors monitoring their authoritative name servers for unexpected queries, passive DNS queries a database of historically observed DNS resolutions. DomainTools operates a global sensor network that captures the exchange between recursive resolvers and authoritative servers, deduplicates results, and makes them queryable within approximately two minutes.

Schwabby demonstrated the pivot chain: starting with a known C2 domain (mskisdakw.googly[.]cook, using the .cook TLD, which he described as a "very dirty TLD"), the team resolved its A record to IP 199.247.6.61, then reverse-pivoted to find 10 additional domains sharing that IP. Pivoting on each of those domains enumerated over 1,100 additional IPs. This recursive pivoting can reveal staged C2 domains not yet deployed, enabling proactive blocking.

The key technical insight: DNS cannot lie and still function. Threat actors can obfuscate ownership, use bulletproof hosting in permissive jurisdictions, and burn domains rapidly, but the DNS resolution chain must be truthful for their infrastructure to work. Passive DNS exploits this fundamental constraint.

Demo / Proof of Concept

▶ Watch: Passive DNS explained: how it works and why it stays covert (25:59)

While not a live hacking demo, Schwabby walked through the DomainTools web interface showing real query results. The demonstration showed looking up A records for the known C2 domain (seven results found), pivoting on IP 199.247.6.61 to discover 10 co-hosted domains, selecting one of those domains, and finding over 1,100 associated IPs. He noted this process can be scripted, automated, or driven by AI through DomainTools' MCP server, which was announced as launching at RSA.

Defensive Implications

▶ Watch: Pivot chain demo: from one C2 domain to 1,100+ IPs (40:00)

The research offers several direct defensive applications. First, organizations should implement domain age and reputation scoring in their security stacks, but be aware that the shift toward newly active (aged but dormant) domains means age alone is insufficient. Second, the identified registrar and hosting patterns (Silo, Zet Technology, Vultr, LightNode) and Let's Encrypt R10/R11 certificates provide concrete indicators for threat hunting rules.

For Android-focused organizations, the SpyNote delivery chain's reliance on sideloading means enforcing restrictions on APK installation from unknown sources remains a high-value control. The multi-stage dropper design means the initial download may not trigger AV, so behavioral detection and network-level monitoring for C2 callbacks are essential.

Passive DNS enables defenders to get ahead of campaigns by enumerating staged infrastructure before it goes live. Block lists can be pre-populated with probable C2 domains discovered through pivot analysis. Schwabby emphasized that passive DNS investigations do not tip off threat actors, unlike active DNS queries that sophisticated operators can detect.

Key Takeaways

• SpyNote is a mature, nation-state-grade Android RAT used by APT34, APT-C-37, and OilAlpha for targeted surveillance of dissidents and humanitarian workers
• Fake Google Play Store pages remain the primary delivery vector, using cloned HTML/CSS and multi-stage encrypted droppers
• Newly active domains are replacing newly registered domains as the preferred tactic, coasting on residual reputation to evade age-based heuristics
• Passive DNS pivot chains can expand a single C2 indicator into a map of over 1,000 IPs and dozens of related domains without alerting the threat actor
• DNS cannot lie and still function, making it an inescapable telemetry source for mapping adversary infrastructure
• DomainTools offers academic grants for researchers and investigative journalists via [email protected]

About the Speaker(s)

Dana Schwabby is the Head of Investigations and CISO at DomainTools, where he leads the DTI program publishing weekly product-agnostic threat research. He has 25 years of experience in cybersecurity, having worked through front-line SOC and security engineering roles in state and federal government and higher education (notably at the University of Washington) before spending the last decade in private industry. He previously ran the engineering team at Farsight Security, which was acquired by DomainTools, and has been doing DNS research professionally for over 10 years.