Tuesday, May 6, 2025
Homecyber securityHackers Abuse DNS Tunneling For Covert Communication & Firewall Bypass

Hackers Abuse DNS Tunneling For Covert Communication & Firewall Bypass

Published on

SIEM as a Service

Follow Us on Google News

As a sneaky scheme, hackers use DNS tunneling to bypass traditional security measures.

By wrapping malicious data inside DNS queries and responses, they can smuggle out sensitive information or talk to command and control servers without getting caught.

DNS tunneling provides an avenue for hackers to employ DNS protocols as covert channels of data exfiltration where the traffic appears legitimate on the face but it is not.

- Advertisement - Google News

Besides this, it incorporates encryption capabilities that make it difficult for security systems to carry out thorough investigations into whether malicious traffic exists.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Cybersecurity researchers at Palo Alto Networks recently discovered that hackers have been actively leveraging the “DNS Tunneling” for tracking and scanning.

Hackers Abuse DNS Tunneling

While DNS tunneling is commonly used for covert C2 communications, cybersecurity analysts recently detected campaigns employing it for network scanning and tracking email delivery or CDN usage. 

For scanning, threat actors tunnel DNS queries to map a victim’s infrastructure. For tracking, they monitor DNS interactions related to malicious emails and CDNs. 

Embedding data in DNS requests and responses allows compromised hosts to communicate through firewalls to attacker-controlled nameservers. 

Data exfiltration and infiltration with DNS tunneling (Source – Palo Alto Networks)

DNS tunneling is stealthy due to the following three factors:-

  • Firewalls allow DNS traffic
  • Communication is indirect between the client and the server
  • Data encoding obfuscates payloads as legitimate traffic

It enables malicious command and control besides legitimate uses. Attackers exploit various DNS record types.

Apart from conventional command-and-control, DNS tunneling also facilitates tracking victims’ activities and scanning network infrastructure. 

The “TrkCdn” campaign tracks email interactions by encoding victim data in unique subdomains, using 658 attacker-controlled domains resolving to 75 nameserver IPs.

The TrkCdn campaign uses DNS tunneling to track victims’ interactions with attacker-controlled email content. It encodes email addresses as MD5 hashes in unique subdomains like:- 

  • “4e09ef9806fb9af448a5efcd60395815.trk.simitor.com for unit42@not-a-real-domain.com” 

Querying these subdomains allows tracking when victims open emails or click links, enabling campaign monitoring.

The domains follow a lifecycle with incubation, active distribution, tracking, and retirement phases spanning over a year. 

Attackers used specific hosting providers’ IP ranges. Another campaign, “SpamTracker,” similarly tracks spam delivery. 

The “SecShow” campaign leverages DNS tunneling for network scanning by encoding target IP addresses and timestamps in subdomains to detect open resolvers, test delays, exploit vulnerabilities, and obtain TTL information, often precursors to attacks.

Mitigations

Here below we have mentioned all the mitigations:-

  • Limit resolver access to necessary internal networks or trusted IP ranges.
  • Configure resolvers to only respond to legitimate queries.
  • Implement access control lists (ACLs).
  • Stay vigilant for updates released by resolver software vendors and promptly apply patches.
  • Implement automated update mechanisms to ensure timely patching of resolver software.
  • Stay informed about N-day vulnerabilities affecting resolver software and prioritize patching accordingly.

IoCs

Domains Used For DNS Tunneling

  • 85hsyad6i2ngzp[.]com
  • 8egub9e7s6cz7n[.]com
  • 8jtuazcr548ajj[.]com
  • anrad9i7fb2twm[.]com
  • aucxjd8rrzh7xf[.]com
  • b5ba24k6xhxn7b[.]com
  • cgb488dixfxjw7[.]com
  • d6zeh4und3yjt9[.]com
  • epyujbhfhbs35j[.]com
  • hhmk9ixaw9p3ec[.]com
  • hjmpfsamfkj5m5[.]com
  • iszedim8xredu2[.]com
  • npknraafbisrs7[.]com
  • patycyfswg33nh[.]com
  • rhctiz9xijd4yc[.]com
  • sn9jxsrp23x63a[.]com
  • swh9cpz2xntuge[.]com
  • tp7djzjtcs6gm6[.]com
  • uxjxfg2ui8k5zk[.]com
  • wzbhk2ccghtshr[.]com
  • y43dkbzwar7cdt[.]com
  • ydxpwzhidexgny[.]com
  • z54zspih9h5588[.]com
  • 3yfr6hh9dd3[.]com
  • 4bs6hkaysxa[.]com
  • 66tye9kcnxi[.]com
  • 8kk68biiitj[.]com
  • 93dhmp7ipsp[.]com
  • api536yepwj[.]com
  • bb62sbtk3yi[.]com
  • cytceitft8g[.]com
  • dipgprjp8uu[.]com
  • ege6wf76eyp[.]com
  • f6kf5inmfmj[.]com
  • f6ywh2ud89u[.]com
  • h82c3stb3k5[.]com
  • hwa85y4icf5[.]com
  • ifjh5asi25f[.]com
  • m9y6dte7b9i[.]com
  • n98erejcf9t[.]com
  • rz53par3ux2[.]com
  • szd4hw4xdaj[.]com
  • wj9ii6rx7yd[.]com
  • wk7ckgiuc6i[.]com
  • secshow[.]net
  • secshow[.]online
  • secdns[.]site

IP Addresses Associated

  • 35.75.233[.]210
  • 202.112.47[.]45

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...