DNSpionage

Internal ID: win.dnspionage

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying win.dnspionage. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

DNSpionage is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog-cert.opmd.fr/dnspionage-focus-on-internal-actions/

→https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html

→https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html

→https://marcoramilli.com/2019/04/23/apt34-webmask-project/

→https://nsfocusglobal.com/apt34-event-analysis-report/

→https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/

→https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf

→https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html

→https://www.lastline.com/labsblog/threat-actor-cold-river-network-traffic-analysis-and-a-deep-dive-on-agent-drable/

→https://www.mandiant.com/resources/blog/global-dns-hijacking-campaign-dns-record-manipulation-at-scale

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.dnspionage

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DNSpionage