While most of the Log4J vulnerability hype has died down, a new botnet utilizing the exploit to spread was discovered by Qihoo 360 Netlab researchers. The botnet, named B1txor20 after it’s file extension, encryption algorithm, and key length, has been under active development since at least February 9th, 2022. The researchers did not state how it utilized the Log4J exploit or the number of devices affected. While it is still relatively young, the botnet appears to have sophisticated features such as a backdoor, rootkit functionality, and a SOCKS5 proxy. The standout feature in the B1txor20 is the use of DNS tunneling techniques to obscure its communications with the command-and-control (C2) server. They do this by sending a DNS request to the C2 server with “stolen sensitive information, command execution results, and any other information that needs to be delivered” as an encoded string prepended to the attacker’s domain name. The C2 server then responds to the DNS request with a payload that indicates what function the bot should perform next. This botnet is a prime example that the fallout of the Log4J vulnerability has not been fully discovered yet.