DNS Tunneling.

DNS tunneling abuses the fact that DNS traffic (UDP/TCP port 53) is allowed almost everywhere and is rarely deeply inspected. Malware encodes payload bytes in subdomain labels (e.g., base32 chunks under attacker.example.com) and the attacker's authoritative server replies with TXT, CNAME, NULL, or A records carrying the response or commands. Because resolution is recursive, the data flows out even when the host can only reach an internal resolver and never touches the attacker's IP directly. Tooling like dnscat2, Iodine, and Cobalt Strike's DNS C2 implement this pattern; throughput is low but stealthy.

Real campaigns rely on it. The 2020 SUNBURST backdoor in SolarWinds Orion used a domain generation algorithm to build subdomains of avsvmcloud.com, then encoded the victim's internal Active Directory domain and list of installed security products into those DNS queries as a two-way C2 channel. The Iranian-linked OilRig/APT34 and DNSpionage operations likewise leaned on DNS tunneling for tasking and exfiltration.

Detection relies on signals attackers struggle to hide: high query rate per host, unusually long labels, high subdomain entropy (base32/base64/hex strings), atypical record types like TXT or NULL, and never-before-seen domains. Defences include forcing all clients through controlled resolvers, blocking direct outbound port 53 at the egress firewall, DNS sinkholing, query rate limits, and anomaly analytics in EDR/NDR.

flowchart LR
  M[Infected host] -->|"data.b32label.attacker.com"| R[Internal resolver]
  R -->|recursive lookup| AUTH[Attacker authoritative NS]
  AUTH -->|"TXT/CNAME reply = command"| R
  R --> M
  AUTH -.reassembles.-> D[(Stolen data and C2)]