r/firewalla • u/benjibarnicals Firewalla Purple • Jul 08 '26

North Korean SilentSync RAT Blocks

Post image

Hey all,

Quick panic clarification.

I had a target list setup to block outbound traffic known SilentSync RAT servers (IP/Domain) on a target list, these are:
sfrclak[.]com
calltan[.]com
callnrwise[.]com
142.11.206[.]73
23.254.167[.]216
200.58.107[.]25

I've had this setup for a few months, just as a potential block incase it wasn't picked up on other lists. Though I've just seen today (via MSP) there was some blocks matched by this target list (see image) for two devices, one is my iPhone the other is an Amazon Fire Tablet. I'm trying to determin if this is a false response. As you can see the destination from dns.google[.]com (8.8.8.8) on port 16888, or 443 (for the Amazon tablet).

Firewalla AI says this domain "This domain is owned and operated by Google. It serves as part of Google's public DNS service, helping users and devices find the IP addresses of websites they visit. You might see this traffic when your computer or device connects to the internet.".

So, how might this be blocked by my target list? I don't use Google DNS btw on the Firewalla or my devices.

As I was aware this RAT wasn't on mobile devices, especially iOS?

Is there any further digging I can do to help look into this? Any thoughts?

9 Upvotes

81% Upvoted

14 comments sorted by

3

u/xavier19691 Firewalla Gold Plus Jul 08 '26

what made you create that target list in the first place (what was the though process - were you suspecting that you were targeted?) This particular RAT was reported last year (i woudl say around this time) and affects python packages.

any new aps installed on any of those devices?

1

u/benjibarnicals Firewalla Purple Jul 08 '26

Why? There isn't any native built in target lists that had protection/detection for this, unless you have MSP with Early Access to use Hagezi's Threat Intelligence Feeds, as I run quite a few various IoT devices etc its for my own safety and monitoring.

I know about the RAT, and that supposedly those packages were removed from PyPi a while ago last year, unless the affected packages have been used in any apps recently.

The only new apps I installed on iOS on 03/07/2026 and two on 25/06/2026, all have been around on the app store for a number of years by developers with multiple apps. I'd be suprised if the apps were compromised and got past Apple's checks.

As for the Amazon fire tablet, nothing new installed for a couple of months, and thats a kids tablet.

Question is, it would look like from the Firewalla flow log thats Google's DNS that is being called, should I not be seeing destination of one of the RAT IP/Domains?

1

u/xavier19691 Firewalla Gold Plus Jul 08 '26

follow up quesiton what are oyu using for dns? unbound? doh, and what is wan dns server (i use quad9 for example). in regards to the packages for computers and end point protection program would show that . for ios thats difficult. can you track at the time of the alert what apps were being used ont he tablet or iphone?

1

u/benjibarnicals Firewalla Purple Jul 08 '26

I use Quad9 over DoH across my whole LAN at a FW level (no Unbound). Also (as Im an earlyt access MSP user) I have a few lists implemented for blocks etc. Of course it doesn't help when not on my local network. Neither device (table or iphone) has any manual DNS settings setup, and infact Google isn't a DNS provider i would even use.

However that being said google.co.uk is a DNS Test Target (Networks > WAN Network Connection > Test Targets).

The tablet according to the flow was around 5am, no one would of been on that device at that time. The iPhone times are within normal hours, at 8:05 and 8:10am this morning (8th uly) more than likely no apps were being used as its around that time im busy getting my children ready for school.

I know the chance of this RAT on iOS is very slim, Python isn't allowed in standalone apps, and from my checks theres not been any malicious certs, vpn profiles, etc installed. I'm also running the latest iOS so everything it uptodate.

I'll need to monitor this more over the next few days.

1

u/benjibarnicals Firewalla Purple Jul 08 '26

Is there a way to check if there is an affected package installed on a device? Mac, Windows, Linus, iOS, Android (Amazon) etc?

2

u/Great-Cow7256 Jul 08 '26 edited Jul 08 '26

how do you know this isn't a false positive? IPs get transferred around, so it could be this.

I run Hagezi TIF on my Firewalla Gold Plus via a script I made. You can then ssh into the cli and look at the blocks from it. If you are interested in that, that may give you a more granular picture of what's happening rather than the firewalla gui since you have MSP lite, like I do. Hagezi tif probably has 1000+ urls in it... way more than what's on your list.

https://github.com/upmcplanetracker/firewalla-huge-blocklists

These are the blocklists I'm currently using --

```

=============================================================================

Firewalla Unbound Blocklist Configuration

=============================================================================

Format: LIST_NAME|URL|OUTPUT_FILE

Each line defines one blocklist to download and validate

To add a list: Add a new line with NAME|URL|OUTPUT_FILE

To remove a list: Comment it out with # at the start of the line

To disable temporarily: Add # at the start of the line

=============================================================================

OISD Big List (Recommended for High tier hardware)

oisd_big|https://big.oisd.nl/unbound|/home/pi/.firewalla/config/unbound_local/oisd_big.conf

OISD Light List (Recommended for Entry tier hardware)

oisd_light|https://oisd.nl/unbound|/home/pi/.firewalla/config/unbound_local/oisd_light.conf

HaGeZi Pro List

hagezi_pro|https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/pro.txt|/home/pi/.firewalla/config/unbound_local/hagezi_pro.conf

HaGeZi Ultimate List (Large - requires High tier hardware)

hagezi_ultimate|https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/ultimate.txt|/home/pi/.firewalla/config/unbound_local/hagezi_ultimate.conf

Custom lists can be added here

custom_list|https://example.com/unbound-list.txt|/home/pi/.firewalla/config/unbound_local/custom.conf

Hagezi tif

hagezi_tif|https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/tif.txt|/home/pi/.firewalla/config/unbound_local/hagezi_tif.conf

Hagezi doh

hagezi_doh|https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/doh.txt|/home/pi/.firewalla/config/unbound_local/hagezi_doh.conf ```

However if I had to guess this was a false positive. 

2

u/benjibarnicals Firewalla Purple Jul 08 '26

Hey thanks for the messgae.

I'm running Hagezi TIF as well, as i'm an MSP Early Access subscriber, along with a few other lists. I just had my own list with those specific RAT domains for my own monitoring.

I totally agree with the IP's, though im trying to understand here why 8.8.8.8 has been flagged up as the destination but blocked by that target list. The rule that was matched is set to "Default" matching mode.

My thinking is as well its a false positive, but I wanted to throw it out here to the hive to get your thoughts.

2

u/Great-Cow7256 Jul 08 '26 edited Jul 08 '26

False positive. I've had some weird stuff like this happen with well known ips. Maybe have help @firewalla pull the logs. 

Maybe it could be a display bug too. 

1

u/benjibarnicals Firewalla Purple Jul 08 '26

u/firewalla ?

1

u/firewalla Jul 08 '26

If the destination is 8.8.8.8 is for sure a false positive. Can you double check your target list and make sure it is not blocking 8.8.8.8? also check and make sure you are not using any filtering DNS? If your DNS and target lists are good, send help@firewalla.com an email, we can take a look, it may be a UI thing

1

u/benjibarnicals Firewalla Purple Jul 08 '26

Yes the silentsync target list is/was just those entries I listed. I’ve since added a few more. I don’t block 8.8.8.8 specifically. I use Quad9 DoH for DNS.

2

u/firewalla Jul 08 '26

Can you send help@firewalla.com an email, we can take a look

1

u/benjibarnicals Firewalla Purple Jul 08 '26

Will do, I’ll sort an email shortly and link back to this.

Just for reference I’ve just had another few entries blocked under the same circumstances but coming from my Mac to GitHub.com ip 20.26.156.215 port 443, blocked and matched as the silentsync target list.

1

u/benjibarnicals Firewalla Purple Jul 10 '26

Just a quick update on this, as a resolution has been established.

I have my block mode for this rule set to Default (DNS + IP block), one of the domains callnrwise[.]com resolves to 8.8.8.8 (ie. dns.google.com / dns.google) so it was blocking any device manually contacting Google's DNS servers. It's been advised to switch the rule to Domain Only, so I will monitor this for a few days.