Hackers use DNS tunneling for network scanning, tracking victims

Caute_cautim — Tue, 14 May 2024 00:44:22 GMT

Hi All

Threat actors are using Domain Name System (DNS) tunneling to track when their targets open phishing emails and click on malicious links, and to scan networks for potential vulnerabilities.

DNS tunneling is the encoding of data or commands that are sent and retrieved via DNS queries, essentially turning DNS, a fundamental network communication component, into a covert communications channel.

The threat actors encode the data in various ways, such as Base16 or Base64 or custom textual encoding algorithms, so they can be returned when querying DNS records, such as TXT, MX, CNAME, and Address records.

https://www.bleepingcomputer.com/news/security/hackers-use-dns-tunneling-for-network-scanning-tracking-victims/

Regards

Caute_Cautim

topic Hackers use DNS tunneling for network scanning, tracking victims in Threats

Hackers use DNS tunneling for network scanning, tracking victims