Fast Flux: A national security threat

This joint advisory from multiple national cybersecurity agencies warns that fast flux DNS — rapid rotation of DNS records and, in double flux, name servers — is being used by cybercriminals and APTs to hide command-and-control, host phishing pages, and increase resilience against takedowns. The report explains single- and double-flux techniques, gives examples of observed use (including ransomware campaigns and Gamaredon), outlines detection heuristics (high IP diversity, low TTLs, geolocation inconsistencies, flow patterns), and recommends multi-layered mitigations for ISPs, Protective DNS providers, and network defenders such as blocking/sinkholing, reputational filtering, enhanced logging, and information sharing.