Detour Dog: Stealthy DNS Malware Uses TXT Records for Command and Control

According to Infoblox, the Infoblox Threat Intelligence team released an in‑depth report on a global malware campaign that used DNS TXT records as a novel command-and-control mechanism, with the threat actor behind it tracked as Detour Dog infecting tens of thousands of websites worldwide. The operation hid its activity by shifting malicious commands into DNS traffic, with the DNS requests made server-side and not visible to visitors.

In mid‑2025 the campaign evolved to allow infected websites to execute code from remote servers, and Detour Dog was a major player in the Strela Stealer campaigns that swept across Europe in summer 2025. Infoblox notes that approximately 30,000 infected hosts were seen within 584 top-level domains in a 48‑hour window, and at its peak the sinkhole received 2 million TXT requests in an hour. The data also showed anomalies, including IPs belonging to organisations such as the U.S.

Department of Defense appearing in the queries, raising questions about bot traffic generation. Detour Dog demonstrated agility in resisting takedowns, switching domains quickly after sinkhole takedowns and establishing new C2s within hours.