Hackers are now hiding malware in DNS, and using AI to reassemble it

WTF?! Security researchers and ethical hackers are uncovering new and unexpected places where malicious code can be hidden within IT infrastructure. Even the seemingly innocuous Domain Name System (DNS) – the foundational naming system for all internet-connected devices – can, in theory, be exploited by clever cybercriminals or state-sponsored attackers. This underlines a growing trend: no part of the digital stack is too mundane to become a vector for sophisticated threats.

Hiding ransomware inside a CPU was strange but now, attackers are going even deeper and broader across networks. In a recent discovery, security researchers revealed that a piece of malware had been embedded directly within the Domain Name System, effectively bypassing nearly all advanced security tools.

Prompted by earlier reports of someone hiding images in DNS records, researchers at DomainTools began scouring DNS TT records for signs of binary or non-standard data. TXT records, which can store arbitrary text and are ...