Conversation

Notices

1. Embed this notice
   k3ym𖺀 (k3ym0@infosec.exchange)'s status on Thursday, 23-Jul-2026 15:08:59 JST k3ym𖺀

   Everyone: “nobody uses DNS tunneling in the real world, it’s a CTF meme.”

   TrickBot 2026: hiding C2 payloads in the high 6 bits of IPv4 responses at 30 KB/s while your DNS logs sit unread in a bucket nobody has queried since 2023.

   That’s not exfil, that’s a dial-up modem with extra steps. And it’s still faster than your change advisory board.

   https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2

   #infosec #threatintel #dns

   • Rich Felker repeated this.
   • Embed this notice
     vk3kri (vk3kri@mastodon.radio)'s status on Thursday, 23-Jul-2026 15:09:41 JST vk3kri

     in reply to

     @k3ym0
     The first time I came across DNS tunneling in the wild was traffic monitoring hardware sold as a security device.. Turns out it was trying to do DNS tunneling to check for a valid licence.. My advice was to dump it was not taken.

     Theres always one weirdo somewhere tailing their DNS logs!