As a sneaky scheme, hackers use DNS tunneling to bypass traditional security measures.
By wrapping malicious data inside DNS queries and responses, they can smuggle out sensitive information or talk to command and control servers without getting caught.
DNS tunneling provides an avenue for hackers to employ DNS protocols as covert channels of data exfiltration where the traffic appears legitimate on the face but it is not.
Besides this, it incorporates encryption capabilities that make it difficult for security systems to carry out thorough investigations into whether malicious traffic exists.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
Cybersecurity researchers at Palo Alto Networks recently discovered that hackers have been actively leveraging the “DNS Tunneling” for tracking and scanning.
While DNS tunneling is commonly used for covert C2 communications, cybersecurity analysts recently detected campaigns employing it for network scanning and tracking email delivery or CDN usage.
For scanning, threat actors tunnel DNS queries to map a victim’s infrastructure. For tracking, they monitor DNS interactions related to malicious emails and CDNs.
Embedding data in DNS requests and responses allows compromised hosts to communicate through firewalls to attacker-controlled nameservers.
DNS tunneling is stealthy due to the following three factors:-
It enables malicious command and control besides legitimate uses. Attackers exploit various DNS record types.
Apart from conventional command-and-control, DNS tunneling also facilitates tracking victims’ activities and scanning network infrastructure.
The “TrkCdn” campaign tracks email interactions by encoding victim data in unique subdomains, using 658 attacker-controlled domains resolving to 75 nameserver IPs.
The TrkCdn campaign uses DNS tunneling to track victims’ interactions with attacker-controlled email content. It encodes email addresses as MD5 hashes in unique subdomains like:-
Querying these subdomains allows tracking when victims open emails or click links, enabling campaign monitoring.
The domains follow a lifecycle with incubation, active distribution, tracking, and retirement phases spanning over a year.
Attackers used specific hosting providers’ IP ranges. Another campaign, “SpamTracker,” similarly tracks spam delivery.
The “SecShow” campaign leverages DNS tunneling for network scanning by encoding target IP addresses and timestamps in subdomains to detect open resolvers, test delays, exploit vulnerabilities, and obtain TTL information, often precursors to attacks.
Here below we have mentioned all the mitigations:-
On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free
Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…
Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…
Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…
Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…
The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…
Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…