By Yaëlle Harel, Principal Security Market Strategist at EfficientIP
Some cyber threats announce their arrival. Others quietly move through networks, hiding in the everyday traffic organizations depend on. And just when security teams think they’ve eliminated a threat, it can resurface in a different form, using new infrastructure to continue the same malicious activity.
DNS is particularly attractive to attackers because it is essential to everyday network operations. Organizations rely on it to connect users and applications to services, but that same constant activity can provide cover for malicious communications. Attackers can exploit DNS to maintain access, communicate with compromised systems and move stolen information without immediately attracting attention.
As Halloween approaches, it’s worth examining the threats that refuse to stay buried and the warning signs that can help security teams identify them before they become a larger problem.
The Threats Hiding in Plain Sight
Some of the most concerning DNS-based threats are dangerous precisely because they blend into legitimate network activity.
With DNS-based data exfiltration, attackers encode stolen information into DNS queries, allowing sensitive data to leave an organization through traffic that may appear routine. It’s the digital equivalent of a thief disguised as a delivery worker, carrying valuables out in ordinary parcels.
DNS can also support persistent compromise. Attackers use DNS-based command-and-control communications to receive instructions, steal information or prepare for ransomware deployment while remaining inside the network. Without visibility into DNS activity, traditional security tools may miss these communications.
The danger isn’t necessarily an obvious disruption. It’s the possibility that an attacker has already established a foothold and is quietly operating in the background.
DNS Zombies: Infrastructure That Keeps Coming Back
Even when malicious infrastructure is identified and disrupted, that doesn’t always mean the underlying threat has been eliminated.
Fast flux is one example. This DNS evasion technique rapidly changes the IP addresses associated with a malicious domain, making the infrastructure harder to block or take down. Security teams may successfully block one IP address, only for the same domain to point to another host.
Domain Generation Algorithms (DGAs) create a similar challenge. Malware can generate large numbers of potential domain names to locate command-and-control infrastructure, allowing malicious activity to continue even as individual domains are blocked.
Some DGA families also exhibit the kind of resurgence that makes them particularly difficult to track. The Phobia DGA family, for example, declined from approximately 62,000 observed device matches in January to just 600–700 per day before resurging to approximately 25,000 in May. What appeared to be a disappearing threat was far from dead.
Attackers can also reuse infrastructure across different phishing campaigns. Following the Olympic Games, for example, infrastructure previously associated with Olympic-themed phishing was repurposed for Halloween-related phishing sites, using the same IP addresses with a different lure.
A decline in activity, a blocked IP address or the end of a campaign doesn’t necessarily mean the threat has disappeared. The infrastructure may simply be waiting for its next use.
The Footsteps Before the Nightmare
One of the most valuable aspects of DNS is that it can reveal suspicious activity before a larger attack unfolds.
Attackers often leave traces as they prepare infrastructure, attempt to establish connections or move stolen information. These signals may seem insignificant individually, but together they can provide early warning that something is wrong.
Several indicators deserve particular attention:
- Newly observed domains: Increases preceded or coincided with phishing peaks in 2025. In 2026, they also rose alongside broader malicious activity during March and April.
- DGA activity: Generated domain names and repeated failed lookups can indicate malware searching for command-and-control infrastructure. DGA activity strengthened in February 2026, ahead of the broader malicious surge.
- Unusual DNS traffic patterns: Sudden query spikes, unusually long queries, repeated NXDOMAIN errors, resolution failures and malformed requests can signal compromise, attempted data exfiltration or attacks targeting DNS infrastructure.
These indicators don’t automatically confirm an attack. However, they provide valuable context that can help security teams investigate suspicious behavior earlier.
Without visibility into DNS activity, organizations risk missing these breadcrumbs until the consequences become much more difficult to contain.
Don’t Wait for the Threat to Reveal Itself
The worst-case scenario isn’t simply a malware infection or disrupted system. It’s an attacker remaining inside an organization long enough to steal sensitive information, establish persistent access and ultimately deploy ransomware.
DNS can support several stages of that activity, from command-and-control communications to data exfiltration. By the time an attack becomes obvious, customer information, intellectual property or other sensitive data may already be compromised.
The consequences extend beyond restoring systems. Operational disruption, reputational damage, lost customer trust and legal or regulatory exposure can continue long after the immediate incident has been resolved.
As organizations confront increasingly persistent threats, the goal shouldn’t be limited to stopping attacks they can already see. It should also be identifying activity hiding within legitimate traffic, recognizing early warning signs and understanding when supposedly eliminated threats begin to resurface.
Because in cybersecurity, some of the most dangerous threats are the ones that never really stay dead.
##
ABOUT THE AUTHOR
Yaelle Harel is Principal Security Market Strategist at EfficientIP, specializing in AI-driven cyber defense, threat intelligence, and DNS security. She brings experience in engineering leadership and cybersecurity strategy, combining technical expertise with a deep understanding of real-world security challenges.
Her work explores how DNS intelligence and AI can help organizations uncover malicious activity, detect emerging threats earlier, and strengthen proactive cyber defense. With more than a decade of experience working with AI, she brings a long-term perspective on its potential and limitations in cybersecurity. She bridges technology, research, and market insights to help organizations understand emerging risks and make informed security decisions.
