Leveraging DNS Tunneling for Tracking and Scanning
Summary: Unit 42 documented three campaigns using DNS tunneling for scanning and tracking rather than the usual command-and-control and VPN purposes, including one it named TrkCdn that targeted 731 potential victims through 658 attacker-controlled domains and 75 nameserver IP addresses. In TrkCdn, MD5 hashes of victim email addresses were embedded as subdomains under a trk label and resolved via wildcard CNAME to an attacker nameserver, letting the operator log when a victim opened an email or clicked a link.
What's compelling: Roughly 80% of TrkCdn victims viewed the campaign's emails only once, and the attacker could read that from their own nameserver logs - meaning the DNS queries your resolvers forward are themselves the tracking signal, and the domains sat in an incubation phase for two to 12 weeks before any payload was sent.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026