DNS Tunneling Abuse Expands to Tracking & Scanning Victims

Unit 42 researchers describe multiple recent campaigns that extend DNS tunneling beyond C2 and exfiltration to include user tracking and infrastructure scanning: TRkCdn tracked email interactions across ~731 potential victims, SpamTracker used tunneling to monitor spam/phishing delivery, and SecShow scanned for open resolvers and exploited resolver behaviors to enable reflection and other DNS-based attacks; defenders are advised to restrict resolver query scope, patch resolvers, and prioritize phishing prevention.