As an important component of the internet architecture, the Domain Name System has historically played the role of an invisible intermediary converting human intent into machine-readable destinations without much scrutiny or suspicion. However, this quiet confidence has now been put to the test.
Research conducted by DomainTools has revealed a subtle yet consequential technique that redefines DNS into a covert delivery channel for malicious code rather than just a directory service.
Rather than hosting payloads on compromised servers or suspicious domains, attackers fragment malware into tiny segments and embed them in DNS TXT records scattered across a variety of subdomains.
The fragments appear harmless when isolated, indistinguishable from legitimate configuration information. However, after systematically querying and reassembling-often by scripting PowerShell commands-the pieces combine to form fully functional malware.
As a result of the implicit trust placed in DNS traffic and the limited visibility many organizations maintain over it, this methodical approach is inexpensive, methodical, and quiet.
According to a report by Ars Technica, DNS infrastructure abuse is not merely theoretical. Threat actors have operationalized the technique in a manner that has been remarkable in its precision. In that instance, the malicious payload was converted into hexadecimal form and separated into hundreds of discrete chunks.
As a result of the registration of whitetreecollective.com and generation of a large number of subdomains, the operators assigned each fragment to a distinct TXT record of the host.
These records, individually, appeared to be indistinguishable from routine DNS metadata which is commonly used for verifying domains, authenticating email, and establishing service configurations. Collectively, however, they constitute a malware repository incorporated into the DNS infrastructure as a whole.
Upon establishing foothold access inside a target environment, the reconstruction process did not require any more conspicuous methods than a series of DNS queries.
Each encoded fragment was retrieved individually using scripted queries, which allowed the payload to be assembled in memory without the need for conventional file downloads or suspicious HTTP traffic.
This retrieval mechanism blends seamlessly into ordinary network activity since DNS requests are ubiquitous and rarely subject to deep inspection, particularly in environments requiring encrypted resolvers.
Even though DNS tunneling has long been associated with data exfiltration and command-and-control communications, the deliberate hosting of malicious payloads across TXT records represents a more assertive evolution in this area.
Through the campaign, people illustrate the importance of comprehensive DNS telemetry, anomaly detection, and policy enforcement within modern enterprise security architectures, and demonstrate how foundational internet protocols, when inadequately monitored, can be repurposed into resilient delivery channels.
Furthermore, investigations into DNS-enabled threat infrastructure revealed the activities of a threat actor identified as Detour Dog, who was the key enabler for campaigns to distribute the Strela Stealer malware. In accordance with Infoblox analysis, the actor is in control of domains hosting the initial malware component a lightweight backdoor called StarFish that is used to deliver the malware chain.
During the first stage, the implant functions as a reverse shell, establishing a persistent communication channel that facilitates retrieving and executing the Strela Stealer payload. Informationblox has been tracking Detour Dog since August 2023, when Sucuri, a company owned by GoDaddy, reported security breaches targeting WordPress sites.
Early operations involved the injection of malicious JavaScript into compromised websites to serve as covert command channels for traffic distribution systems using DNS TXT records. Visitors were silently directed to malicious sites or fraudulent pages.
Historical telemetry indicates a sustained and evolving presence of the actor since February 2020, suggesting that its infrastructure extends back as far as February 2020.
Operational model has since matured. Where redirects once supported scams, DNS-based command-and-control frameworks now permit staged execution of remote payloads.
According to IBM X-Force, StarFish is delivered through weaponized SVG files, enabling persistent attacks and hands-on access to compromised systems.
A financially motivated operator has been identified as Hive0145 since at least 2022 as the sole operator responsible for the Strala Stealer, a criminal operation that has been functioning as an initial access broker monetizing unauthorized access to networks by reselling them to other criminals.
Further, Detour Dog's DNS infrastructure was found to play a major role in 69 percent of confirmed StarFish staging hosts, highlighting its central role in the broader campaign.
Additionally, the attack chain included a MikroTik-based botnet, marketed as REM Proxy, which was armed with SystemBC malware previously analyzed by Black Lotus Labs at Lumen Technologies.
In addition to REM Proxy, Tofsee botnet, which historically propagated through PrivateLoader C++ loader, was also responsible for spam emails that delivered Strela Stealer.
Detour Dog's infrastructure consistently hosted the first-stage payload on both distribution pathways, confirming the actor's role as a crucial DNS-centric facilitator within Strela's ecosystem.
When Detour Dog first emerged as a threat intelligence source, its activities seemed relatively simple.
The primary use of compromised websites was to redirect visitors to fraudulent advertising networks, scam websites, and deceptive CAPTCHA pages that are intended to generate illegal revenue through forced clicks. However, telemetry indicated a strategic shift by late 2024.
Initially, the infrastructure served as a traffic monetization strategy, but it soon became a distribution backbone for materially more dangerous payloads.
A DNS-centric framework was observed to facilitate the delivery of Strela Stealer, a family of malware that steals information associated with the threat actor Hive0145, in mid-2025.
The Strela campaigns, usually initiated through malicious email attachments themed around invoices, are intended to exfiltrate user credentials, session information, and host information stored in browsers.
There is no indication that Detour Dog directly hosts final-stage malware binaries.
In reality, it appears to operate as a DNS relay layer, resolving staged instructions and retrieving remote payloads from attacker-controlled servers before relaying them through compromised web assets. Indirection obscures the true origin of malware and complicates the static blocking process.
A detailed description of Detour Dog's operation remains unclear. It is unclear whether it functions solely as an infrastructure provider or concurrently runs its own campaigns.
According to an analysis of infrastructure overlap and domain control, Detour Dog has provided DNS channels to other operators, including Hive0145, for distribution of payloads.
According to internal research, nearly two-thirds of the staging domains associated with recent campaigns are controlled by Detour Dog, suggesting a delivery-for-hire model as opposed to a single threat operation whose focus is on a single, isolated threat.
The primary entry point into the ecosystem continues to be email. Malicious attachments often masquerade as invoices or business documents and initiate a multi-stage infection process.
This documentation does not embed the final payload in its entirety, but instead refers to compromised domains that query Detour Dog's name servers for further instructions.
By using DNS lookups as a precursor to remote execution, ostensibly benign clicks can be transformed into covert downloads and staging sequences as a result of a server-side retrieval process.
Mass distribution has been linked to botnets such as REM Proxy, a MikroTik-based network, and Tofsee, while Detour Dog provides persistent hosting and DNS command and control relays to protect backend infrastructure against direct exposure.
The segmentation of responsibilities reflects the increasingly modular nature of cybercriminals' supply chains.
Among the groups, one manages spam dissemination, another provides DNS and hosting infrastructure resilience, and a third develops and operates the information-stealing payload. Such compartmentalization makes attribution and disruption difficult.
A single component rarely dismantles an operation; actors can reconstitute infrastructure or redirect traffic in a matter of seconds if a single component is removed.
As such, defensive strategies must include DNS-layer intelligence capable of detecting anomalous TXT record queries as well as covert command channels prior to downstream payload execution.
The example of Detour Dog demonstrates how foundational internet protocols can be used to deliver stealth payloads.
It has been observed that threat actors embed malicious orchestration in routine DNS activity to transform everyday web traffic into an unobtrusive mechanism to deliver malware and exfiltrate data.
As part of the prevention of this class of threat, organizations should elevate DNS from a background utility to a frontline security control by integrating visibility, validation, and enforcement across both email and resolution layers.
There are wider implications for security leaders than just a single campaign or actor.
Adversaries have begun weaponizing core internet infrastructure in a structural way by combining email lures, DNS staging, and modular malware services. Defense systems based primarily on perimeter filtering and endpoint detection are unlikely to identify threats that arise through routine name resolution.
In order to maintain DNS observability, organizations must implement a strategy that correlates resolver telemetry with email security signals, enforces strict egress policies, verifies record integrity, and integrates threat intelligence into recursive as well as authoritative layers.
DNS configuration auditing, anomaly detection of irregular TXT record patterns, and rigorous segmentation of web-facing assets are three effective ways to reduce exposure. As adversaries continue to operationalize trusted protocols for covert delivery, resilience will increasingly rely on disciplined architectural design that treats DNS as a decisive defense line rather than a background infrastructure.
