Open post B'ad Samurai @badsamurai@infosec.exchange · 2mo ago Replying to @k3ym0@infosec.exchange Everyone: “nobody uses DNS tunneling in the real world, it’s a CTF meme.” TrickBot 2026: hiding C2 payloads in the high 6 bits of IPv4 responses at 30 KB/s while your DNS logs sit unread in a bucket nobody has queried since 2023. That’s not exfil, that’s a dial-up modem with extra steps. And it’s still faster than your change advisory board. https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2 #infosec #threatintel #dns @k3ym0@infosec.exchange it’s really fkn good work. The FortiLabs RSS if off the hook AND they don’t fill it with sales junk. #AAaA++A+will_bid_again!1!