Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 21:19:48 UTC
Home > List all groups > List all tools > List all groups using tool DNSMessenger
 Tool: DNSMessenger
Names
DNSMessenger
TEXTMATE
Category Malware
Type Tunneling
Description
DNSMessenger makes use of DNS TXT record queries and responses to create a
bidirectional Command and Control (C2) channel. This allows the attacker to use DNS
communications to submit new commands to be run on infected machines and return the
results of the command execution to the attacker.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 13 May 2020
Download this tool card in JSON format
All groups using tool DNSMessenger
Changed Name Country Observed
APT groups
 Carbanak, Anunak 2013-Apr 2023
 FIN7 2013-Jul 2024
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=144b25e9-f0dc-479b-8eec-9fbeba5560d2
Page 1 of 2

2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=144b25e9-f0dc-479b-8eec-9fbeba5560d2
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=144b25e9-f0dc-479b-8eec-9fbeba5560d2
Page 2 of 2

APT groups Carbanak, Anunak  2013-Apr 2023
FIN7  2013-Jul 2024
 Page 1 of 2