US, Australia, Canada warn of ‘fast flux’ scheme used by ransomware gangs

Cybersecurity agencies warn that cybercriminals and nation-state actors increasingly use the fast flux DNS technique—frequently via botnets and bulletproof hosting—to rapidly rotate IPs (single flux) and name servers (double flux), enabling resilient command-and-control, evasion of IP blocking and law enforcement takedowns; the advisory cites use by ransomware groups (Hive, Nefilim) and Russian-aligned Gamaredon and highlights the renewed operational refinement and broad adoption of the technique.