Researchers have revealed new details about “Decoy Dog”, a sophisticated toolkit discovered in April 2023 that has observed activity largely in Russia and Eastern Europe. Decoy Dog is a remote access trojan (RAT) toolkit based on the “Pupy” open-source post-exploitation RAT and utilizes DNS to establish command-and-control (C2). The toolkit has a wide array of capabilities, such as “the ability to move victims to another controller, allowing them to maintain communication with compromised machines and remain hidden for long periods of time.” Researchers suspect that approximately four (4) actors are operating the malware and noted that, despite many aspects of the toolkit being unknown, nation-state threat actors are likely utilizing it. It is currently believed that there are roughly twenty-four (24) Decoy Dog nameservers, controllers, and domains as well as fewer than one hundred (100) devices compromised by the malware as of July 25, 2023. Researchers emphasized that Decoy Dog and Pupy “take advantage of the lack of DNS oversight that often occurs in networks” and that Decoy Dog was discovered solely because of DNS threat detection algorithms. CTIX analysts will continue to monitor the evolution of Decoy Dog and provide updates as necessary.