CopperDragon tooling linked to China-nexus espionage across three regions
SilentDelivery, OceanGate and DarkWire hit telecom, government and critical infrastructure with shared backdoors and credential tools.
1
Stories per day · 30 days
1 RSS
9 stories, newest first · one card per story
Stories tagged #dns-tunneling
Iranian VPN-over-DNS Activity Generates 40 Billion DNS Observations During Military Conflict
DomainTools traced 40 billion DNS observations to suspected Iranian VPN-over-DNS tunneling during a March 2026 conflict.
1
Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations
Partisan Zmiy hid the Vasilek backdoor in VMware Tools during a two-year medical-organization intrusion.
2
Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks
Operation Master exploited GlobalProtect CVE-2026-0257, deployed AdaptixC2, and ran large-scale credential theft and invoice fraud.
5
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.
xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations
xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.
xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection
xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.
Threat Assessment: Ryuk Ransomware
Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.
3
Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic
Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.
4