Understanding DNS Tunneling Traffic in the Wild
Summary: Unit 42 Palo Alto Networks published a study drawing on over four years of DNS tunneling traffic investigations, finding that beyond threat actors using the technique for command and control, enterprise employees use it for censorship circumvention and vehicle passengers use it to bypass network service charges. The researchers built an attribution system called DNS Security System that identifies the tools and associated campaigns behind tunneling domains in real time, and they describe campaigns including FinCounter, FinSupport and Decoy Dog, plus Astrill VPN's use of 49 tunneling domains sharing two nameserver IPs.
Key Takeaway: Most enterprises apply permissive DNS policies because the protocol is fundamental, so attackers reach the internet through port 53 while hiding in the volume of benign DNS traffic - and the same permissiveness lets employees run DNS-tunneling VPN services inside your network, which an IT department can only identify and handle on a per-case basis.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026