DNS Tunneling in Modular Malware: The Threat That Slips Past Traditional Firewalls

A recent technical analysis detailed a banking malware variant that abandoned traditional command and control channels in favor of something far harder to block: the DNS protocol. The discovery reinforces a trend Brazilian security teams have already been observing in real incidents: the use of legitimate infrastructure channels to hide malicious communication within normal network noise.

The case illustrates well why defenses based solely on signatures or known-IP blocking lose effectiveness against modern threats, and why the right response relies on continuous behavioral visibility, not just another firewall layer.

What DNS tunneling is and why it works

DNS is one of the few protocols that virtually no organization blocks or inspects deeply. It needs to be always available, flows freely through most perimeters, and is rarely treated with the same suspicion as HTTP or SMTP. It is exactly this implicit trust that DNS tunneling exploits.

In practice, the malware encodes data within subdomains of legitimate DNS queries. A server controlled by the attacker responds to these queries as if it were a normal authoritative DNS server, but is actually receiving commands and sending instructions back, hidden inside TXT, CNAME, or A records. To a perimeter firewall, that looks like just another name resolution. To the attacker, it's a functional, resilient command and control channel that's difficult to correlate with malicious activity.

The variant analyzed combines this channel with features that further increase detection difficulty:

• Modular execution: components loaded on demand, reducing the visible footprint on disk.
• Silent persistence: mechanisms that survive reboots without relying on obvious scheduled tasks.
• Layered obfuscation: code and strings scrambled specifically to hinder automated reverse engineering.

None of these techniques is revolutionary on its own. What makes the combination dangerous is exactly that: a C2 channel that goes unnoticed, a payload that adapts after initial infection, and an obfuscation chain designed to slow down both human analysts and signature engines at the same time.

Why the traditional perimeter doesn't solve it

Companies that still treat network security as a firewall-and-antivirus problem tend to have a false sense of coverage against this type of threat. Malicious DNS traffic doesn't trigger conventional IPS alerts because it doesn't resemble an exploit, doesn't match known signatures, and, in terms of volume, blends into the legitimate DNS traffic that any corporate network generates by the thousands per minute.

Effective detection depends on a different approach: behavioral analysis of DNS traffic over time. Signals such as abnormal query volume to a single domain, high entropy in subdomain names, query patterns at regular intervals typical of beaconing, and domains with recent reputation or suspicious registration are the indicators that effectively separate malicious tunneling from normal name resolution. That requires continuous correlation, not a static firewall rule.

This is exactly the kind of work a well-structured SOC and MDR needs to do constantly, cross-referencing DNS, endpoint, and network telemetry to identify patterns that no single tool can catch on its own. At Intelliway, ISA Cyber operates precisely at this correlation layer, using AI agents to analyze telemetry volumes that would be impossible to review manually, flagging anomalous DNS behavior before it escalates into data exfiltration or lateral movement.

The role of threat intelligence

Another relevant point in this case is that the variant was identified through deep technical analysis, not antivirus signatures. That means that by the time an organization is hit, the malware has likely already gone unnoticed by traditional controls for some time.

That's the central argument for investing in Threat Intelligence as part of a defense strategy, not as an optional item. Knowing in advance the indicators of compromise associated with active campaigns, the domain patterns used for tunneling, and the obfuscation tactics in use allows the security team to fine-tune detections before becoming a victim, rather than reacting after the data has already left.

Practical recommendations for security teams

Faced with threats that use DNS as a C2 channel, a few concrete measures make a real difference:

1. Enable full DNS logging on internal resolvers, not just edge servers. Without this data, retroactive investigation isn't possible.
2. Implement entropy and volume analysis on DNS queries, identifying domains with statistically abnormal patterns.
3. Restrict direct outbound DNS resolution from endpoints, forcing all traffic through monitored corporate resolvers.
4. Integrate DNS telemetry into the SOC's detection pipeline, cross-referencing it with endpoint and proxy data to reduce false positives.
5. Maintain active vulnerability management, since initial infection usually exploits known flaws or social engineering before the C2 channel is established.

On this last point, it's worth remembering that a large share of incidents that escalate into full compromise start with a vulnerability that was already known and not patched in time. Structured, continuous management programs, like those ISA Insight supports within the VOC, help close that entry point before the attacker needs to resort to sophisticated C2 techniques to stay in the environment.

Conclusion

The use of DNS tunneling in modular malware isn't an isolated technical novelty, it's a reminder that static perimeters are no longer enough. Effective defense requires continuous visibility over protocols that have historically received little attention, real-time behavioral analysis, and up-to-date threat intelligence to anticipate tactics before they become incidents. Companies that treat security as a living process, backed by AI and specialized operations, have a much better chance of identifying this kind of hidden channel before it causes real damage.

If your company wants to assess its detection maturity against evasion techniques like DNS tunneling, talk to the Intelliway team at /empresa#contato.