Hackers use DNS tunneling for network scanning, tracking victims

**Unit 42** uncovered active DNS tunneling campaigns—'TrkCdn' used to track phishing email interactions and 'SecShow' used to scan networks—where attackers encode identifiers and data into DNS queries and leverage DNS records (CNAME, TXT, etc.) as a covert channel for tracking, reconnaissance, and potential C2/data exfiltration; defensive recommendations include DNS traffic monitoring, anomaly detection, and restricting resolvers.