#ParsedReport #CompletenessLow
09-10-2026

It Always Comes Back to DNS: Iranian VPN-over-DNS Activity in the 2026 Conflict

https://dti.domaintools.com/securitysnacks/it-always-comes-back-to-dns-iranian-vpn-over-dns-activity-in-the-2026-conflict

Report completeness: Low

Actors/Campaigns:
Oilrig

Threats:
Dns_tunneling_technique
Smuggling_technique
Trickbot
Sunburst

Victims:
Iranian regime, Dns infrastructure

Geo:
Iran, Iranian, Israel, Asia

ChatGPT TTPs:
do not use without manual check
T1001, T1071.004, T1572

IOCs:
Domain: 8

Soft:
Linux, Windows Powershell, Cloudflare

Algorithms:
base64

Win Services:
Bits

Platforms:
intel