China-Linked 'Muddling Meerkat' Hijacks DNS to Map Internet on Global Scale

Infoblox identified a previously undocumented Chinese nation-state DNS operation dubbed "Muddling Meerkat" active since October 2019 that abuses the Great Firewall to inject false MX resource records via open resolvers worldwide. The actor generated anomalous MX queries for over 20 well-known domains, suggesting sophisticated DNS-based reconnaissance or internet-mapping activity, though the full motive and scope remain unclear.