For flux sake: CISA, annexable allies warn of hot DNS threat

CISA and partner agencies issued an advisory on fast flux DNS techniques—where attackers rapidly change DNS records (single- and double-flux) to hide malicious servers and build resilient C2—highlighting detection challenges (low TTLs, high churn), recommending DNS filtering, anomaly detection, PDNS services, and other mitigations, and citing use by ransomware groups (Hive, Nefilim) and nation-state-linked actors (Gamaredon).