No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

**Executive Summary:** This Unit 42 report analyzes four previously undisclosed DNS tunneling campaigns—FinHealthXDS, RussianSite, 8NS, and NSfinder—describing shared infrastructure and encoding attributes used to cluster domains, linking campaigns to malware families (Hiloti, IcedID, RedLine), providing examples of tunneling formats, passive DNS observations, IoCs (domains, IPs, sample hashes), targeted sectors (finance, healthcare, education, government), and recommended protections via Palo Alto Networks products and signatures.