DNS Tunneling in the Wild: Overview of Oil Rig’s DNS Tunneling
Summary: Unit 42 published an overview of DNS tunneling used by the OilRig threat group, which it has tracked since early 2016 and which has delivered Trojans using DNS for command and control since at least May 2016. The analysis covers five tools - Helminth, ISMAgent, ALMACommunicator, BONDUPDATER, and QUADAGENT - which differ in DNS query type (A, AAAA, TXT), encoding (base16 or base64), and query method, with QUADAGENT transmitting the most data per query at 45 bytes and the updated BONDUPDATER receiving the most at 186.75 bytes.
What's compelling: OilRig has kept introducing new DNS tunneling tools since May 2016, and the updated BONDUPDATER can pull 186.75 bytes from a C2 in a single TXT answer - traffic that looks like ordinary DNS resolution.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026