Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.123 The simplest, "single-flux" method, involves registering and de-registering an address as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.4 In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.
- MehtaFastFluxPt1
- MehtaFastFluxPt2
- Fast Flux - Welivesecurity
- Fast Flux - Welivesecurity
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0092 | TA505 | — |
| grp_g0045 | menuPass | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.