DNS Exfiltration Campaign

A hybrid attack combining human planning with automated DNS exfiltration tools has been detected and successfully misdirected. The attacker encoded stolen data as DNS TXT record queries to attacker-controlled domains. The CIE intercepted the exfiltration channel and replaced genuine data with convincing but fabricated records. The attacker has exfiltrated 14MB of poisoned data believing it to be customer records. Meanwhile, the genuine data channels have been sealed and all affected systems are under enhanced monitoring.