Threat actors are using Domain Name System (DNS) tunneling to track when their targets open phishing emails and click on malicious links, and to scan networks for potential vulnerabilities.

https://www.bleepingcomputer.com/news/security/hackers-use-dns-tunneling-for-network-scanning-tracking-victims/

Hackers use DNS tunneling for network scanning, tracking victims

Threat actors are using Domain Name System (DNS) tunneling to track when their targets open phishing emails and click on malicious links, and to scan networks for potential vulnerabilities.

BleepingComputer
@BleepingComputer
„Additionally, it's advisable to limit the DNS resolvers in the network to handle only the **necessary** queries, reducing the potential of DNS tunneling misuse.“
What do you mean by this?
#DNSTunneling
After looking at the graphics I am curious if malicious.site is actually involved in this or if they are just innocent bystanders getting accused of something they didn't do.
@BleepingComputer Anyone can use #DNS transport and it's trivial. https://dnskv.com is a free key value data store over dns which doesn't require any other protocols than pure DNS.
dnskv.com - DNS Key Value Storage

Store and retrieve data over raw DNS protocol and test for DNS leaks