If you were at today’s Backdoors & Breaches APAC game, this is the report that ChatGPT o3 Deep Research produced. It’s quite good.

DNS as a C2 Channel: Why Attackers Use It and How It Works

DNS has long been abused as a covert channel for command-and-control (C2) because it is nearly always allowed and seldom monitored closely (DNS C2 Sandwich: A Novel Approach - Gigamon Blog). Malware authors take advantage of the fact that DNS traffic is critical for network operations and usually trusted. By tunneling data or commands inside DNS queries and responses, attackers can communicate with compromised hosts without raising immediate suspicion (DNS C2 Sandwich: A Novel Approach - Gigamon Blog). Common DNS C2 techniques include:

Beaconing: Infected hosts periodically perform DNS lookups (e.g. every X seconds) to a C2 domain as a heartbeat. These regular intervals can be a giveaway of malware beaconing behavior. Unlike normal DNS usage (which is user-driven and sporadic), beaconing DNS traffic is automated and highly periodic, often with minimal jitter to evade detection.
Subdomain Encoding (Data Exfiltration): Attackers embed stolen data or commands into DNS queries by using unique subdomain strings. For example, a malware might encode data (sometimes Base32/Base64 or encrypted) and append it as a