Threat Brief: Understanding Domain Generation Algorithms (DGA)
Summary: A Domain Generation Algorithm is a program that generates domain names in a particular fashion so malware can quickly produce a list of domains for its command-and-control sites, letting attackers switch domains faster than defenders can block and take them down. Unit 42 notes DGA has been in regular use since at least 2008, was a key component of the Conficker attacks in 2008 and 2009, and that many DGAs use hundreds or even thousands of domains that stay up only for limited periods.
What you should know: Defenders must decode the algorithm to predict the domains, then work with ISPs to take them down one by one, which Unit 42 describes as a sometimes-futile game of whack-a-mole against lists that can run to thousands of domains.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026