How malware abuses DNS

Filed under Security on July 17, 2026 · updated

DNS tunnelling, command-and-control, domain generation algorithms, exfiltration, fast flux, and DoH abuse, with real campaigns and how defenders catch them. Part 4 of a DNS series.

DNS is trusted, everywhere, and rarely blocked, which is why attackers use it: tunnelling data out, running command-and-control, generating throwaway domains to dodge blocklists. This is the defensive view: how each technique works, real cases, and how it’s caught. For the protocol itself, start with how DNS works.

Tunneling

ATT&CK T1071.004

The attacker owns a domain and runs its authoritative server. Data is encoded into the subdomain labels going out, and answers ride back in TXT / NULL / CNAME records. The victim only ever talks to its normal resolver, which forwards the queries, so the tunnel slips straight through egress filtering.

n0uqbn3xkr2.af9d21.tunnel.example. IN TXT?

base32 payload · label ≤ 63 B, name ≤ 255 B · low throughput, high latency

Documented in the wild

How it's caught: Long, high-entropy names; many unique subdomains under one parent domain; a burst of TXT / NULL queries from one host.

C2 channel

ATT&CK T1071.004

Commands and results are carried in DNS fields, often as low-and-slow beacons that blend into ordinary lookups. DNS is rarely blocked on corporate networks, so it is a reliable back channel.

Documented in the wild

  • DNSMessenger fileless PowerShell RAT with a two-way channel over TXT records (Cisco Talos, 2017)
  • OilRig / Helminth, BONDUPDATER Iranian-nexus trojans using DNS tunneling for C2, TXT-based (Unit 42)
  • SUNBURST encoded victim identity into avsvmcloud[.]com subdomains, then handed off via CNAME (Mandiant)

How it's caught: Regular, low-volume queries to a single domain (beaconing); disproportionate TXT traffic from one endpoint.

DGA

ATT&CK T1568.002

Malware algorithmically generates thousands of candidate domains from a seed plus the current date, then resolves them until it hits the one the operator registered for that day. You cannot pre-block domains you cannot predict, which defeats static blocklists and takedowns.

kqkz0rmxvopht.info NXDOMAIN tj3n8wq2ldacs.info NXDOMAIN ptvbuk9raewf.info 45.13.x.x (live C2)

the client walks its daily list until one answers

Documented in the wild

  • Conficker UTC-date DGA; variants A/B made ~250 domains/day, variant C escalated to ~50,000/day
  • SUNBURST DGA-style subdomain scheme encoding the victim, under one fixed parent domain (Mandiant)

How it's caught: Bursts of NXDOMAIN answers for random-looking names; newly registered domains; ML DGA classifiers over query logs.

Exfiltration

ATT&CK T1048

Stolen data is chunked, encoded, and packed into the query names sent to the attacker's authoritative server, which reassembles it from its query logs. Mechanically it is tunneling, but usually outbound-only and aimed at bulk theft.

4d616c776172655f63617264.exfil.example. IN A?

hex/base32 chunk of the stolen record in each query

Documented in the wild

  • FrameworkPOS point-of-sale malware that exfiltrated stolen credit-card data over DNS (MITRE T1048)

How it's caught: High volume of unique, long subdomains to one domain; query names that carry data-shaped entropy.

Fast flux

ATT&CK T1568.001

One domain is mapped to a large, churning pool of compromised proxy hosts by rotating its records with very short TTLs. Single flux cycles the A records; double flux also cycles the NS records, hiding the true origin behind a second layer.

bad.example. 30 IN A 91.x.x.1 bad.example. 30 IN A 203.x.x.7 (same name, new IPs every few minutes)

TTL ~30–300 s so blocklists never catch up

Documented in the wild

  • Fast Flux DNS used broadly by botnets and phishing kits to keep C2 resilient against IP blocking (MITRE T1568.001)

How it's caught: A single name resolving to many IPs with very low TTLs; rapidly changing A / NS answers.

DoH abuse

The same encryption that protects you also hides malware. By doing DNS over HTTPS to a public resolver, an implant conceals both its queries and the fact that DNS is happening from monitors that only watch UDP/53.

Documented in the wild

  • Godlua widely cited as the first malware to use DoH, pulled C2 addresses via TXT records over DoH (360 Netlab, 2019)

How it's caught: Endpoints reaching public DoH resolvers instead of the enterprise one; force all DNS through an inspected internal resolver.

Defenders lean on passive DNS (retro-hunting), Response Policy Zones (a resolver-level DNS firewall), newly-registered-domain and threat-intel feeds, and egress control, only the enterprise resolver may reach port 53.

References

MITRE ATT&CK techniques:

  • T1071.004: Application Layer Protocol: DNS (tunnelling and C2).
  • T1568.002: Domain Generation Algorithms.
  • T1568.001: Fast Flux DNS.
  • T1048: Exfiltration Over Alternative Protocol.

Campaign and technique reporting:

DNS series

  1. How DNS works
  2. Inside a DNS packet
  3. Encrypting DNS
  4. How malware abuses DNS (this post)

Practical companion: Which resolver to choose.

Last updated on
-- views