No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection
Summary: Unit 42 describes four previously undisclosed DNS tunneling campaigns found by a new campaign monitoring system that correlates shared attributes across tunneling domains rather than examining them one at a time. The campaigns include FinHealthXDS, 12 domains using a customized Cobalt Strike DNS beaconing format against finance and healthcare, and RussianSite, over 100 domains sharing one Russian nameserver IP and targeting 10 organizations in higher education, government and public infrastructure, medical and health institutions, and a public accounting firm.
Key Takeaway: Many organizations leave UDP and TCP port 53 open and unmonitored, which is exactly the covert channel these campaigns use for data exfiltration and command and control. RussianSite alone reached 10 organizations across higher education, government, healthcare and accounting, so the question is whether anyone is watching port 53 in yours.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026