Detour Dog Caught Running DNS-Powered Malware Factory for Strela Stealer

Detour Dog has been identified as powering campaigns distributing Strela Stealer, with Infoblox tracing the threat actor to control domains hosting the stealer’s first stage, including a backdoor called StarFish. According to Infoblox, Detour Dog’s infrastructure has been used to host StarFish, a simple reverse shell that serves as a conduit for Strela Stealer, and traces of the actor date back to February 2020 while they have tracked them since August 2023.

Infoblox’s analysis also found that at least 69% of StarFish staging hosts were under Detour Dog’s control, and noted a MikroTik botnet advertised as REM Proxy, powered by SystemBC, as part of the attack chain. The campaign involves DNS TXT records used to deliver commands and fetch the StarFish downloader, with responses guiding infected sites to fetch further Strela C2 URLs from verified Strela Stealer C2 servers as of June 2025.

In July and August 2025, Infoblox, with Shadowserver Foundation, sinkholed two Detour Dog C2 domains (webdmonitor[.]io and aeroarrows[.]io), highlighting Detour Dog’s shift into malware distribution and distribution-as-a-service modelling. Dr. Renée Burton of Infoblox described how the botnets were contracted to deliver spam while Detour Dog delivered the malware.