216.73.216.226

The Group Theory Inside Bedep's DGA

· Published 22/04/2026 22:57 · Modified 27/04/2026 14:36

Export JSON

Essential information

Published
22/04/2026 22:57
Modified
27/04/2026 14:36
Tags
2026-04-22 CVE-2015-0311 ad-fraud botnet angler angler exploit kit bedep cyclic groups dga domain generation algorithm foreign exchange rates group theory
Related entities
1 vulnerabilities (cve), 1 observables, 16 techniques (mitre), 2 malware, 2 others

Description

was an active from late 2014 through 2015, delivered through the . It employed an unusually sophisticated that used real from the European Central Bank combined with advanced mathematics to generate command-and-control domains. Unlike typical DGAs that rely solely on date-based seeds, 's algorithm fetched currency exchange rates and UTC timestamps from legitimate public sources, making future domains unpredictable until the data was published. The malware implemented mathematical concepts including , primitive root generators, and modular arithmetic to ensure collision-free domain generation. This unique approach made it significantly harder for defenders to pre-compute and block domains compared to conventional DGAs, as the exchange rates couldn't be predicted in advance.

External references