The shape-shifting technique is portrayed as a threat to national security.
On Thursday, the U.S. government’s Cybersecurity and Infrastructure Security Agency, known as CISA, called upon organizations, Internet service providers, and security companies to bolster their defenses against what are referred to as fast-flux attacks.
Fast flux involves concealing malicious servers through a straightforward method of quickly changing their Domain Name System (DNS) entries.
The CISA, the FBI, along with cybersecurity agencies from Australia, Canada, and New Zealand — clearly maintaining communication with the U.S. even amid annexation concerns — view this kind of DNS manipulation as a risk to national safety. While fast-flux techniques might not cause as much alarm as statements from government leaders, they remain an ongoing danger instead of just potential trouble.
Cybercriminals and state-sponsored hackers employ fast flux techniques to hide the actual locations of malicious servers by swiftly altering DNS entries," stated CISA in its advisory [PDF]. "Furthermore, this method allows them to establish robust, easily accessible C2 infrastructures, thereby masking their ensuing nefarious activities.
DNS maps domain names, such as google.com, to numeric network IP addresses like 142.250.191.46. When a crook or government spy infects a victim's computer with malware, that software nasty can look up a specific domain name, such as something programmed in like malware.example.com, to get that full domain name's latest IP address from its DNS records. The malware then connects to the server at that IP address to receive instructions from its controllers and to send stolen data.
At regular intervals, usually between three to five minutes, the domain name system (DNS) for malware.example.com gets automatically refreshed by the creators of the malware. This change ensures that the domain now points to an alternate server’s IP address, which remains under their control. Such maneuvers enable the malicious software to evade network filters designed to block communications with recognized harmful IPs. The continuous shift from one IP address to another transforms this tactic into a perpetual version of the arcade game Whac-A-Mole.
One might use DNS filtering to intercept queries for recognized malicious domains. However, malware can dynamically generate new domain names on the spot, turning mitigation into a constant game of Whac-A-Mole. For instance, sequences like malware.abc.example.com, malware.def.example.com, malware.jkl.example.com, and so forth, illustrate this simplistic approach.
According to MITRE, fast flux has two unpleasant variations: single flux and double flux. In single flux, the DNS A record (or AAAA record for IPv6) that links the domain name with an IP address is frequently altered. With double flux, not only is the DNS A record modified but so too is the authoritative nameserver associated with that record via the DNS NS record for the DNS zone file (which encompasses all DNS entries for the domain). This process might also include updating the DNS CNAME (Canonical Name) record.
According to CISA, both methods depend on botnets—large numbers of hijacked servers—that function as intermediaries, making it harder to obstruct or dismantle hostile networks. When needed, the malware checks for updated IP addresses associated with specific domains and then reaches out to these intermediary nodes to obtain new directives and transmit stolen data.
The cybersecurity organization highlights the use of fast flux techniques in incidents involving the Hive and Nefilim ransomware attacks, along with activities linked to the Gamaredon Group.
In their report, CISA and others suggest employing a mix of detection and defensive strategies, including leveraging threat intelligence feeds alongside perimeter firewalls, DNS resolvers, and SIEM (Security Information and Event Management) services.
Government agencies have pointed out that it’s important to consider TTL (time-to-live) values as well. These settings in DNS records instruct resolvers about the duration for which they should store cached queries before seeking fresh information.
The alert states, "Fast flux domains frequently exhibit significantly short TTL values." It further explains, "Usually, a fast flux domain might alter its IP address as quickly as every three to five minutes."
The problem highlighted by the regional Internet registry APNIC in 2019 is that "half the internet operates with a one-minute Time To Live (TTL) value or lower, and approximately seventy-five percent use a TTL of five minutes or shorter." Given that three out of every four domain names have these minimal TTL settings, this will likely lead to numerous false alarms during monitoring efforts.
The CISA and their allied partners under tariff measures suggest several strategies: deploying anomaly detection systems for DNS monitoring; examining DNS resolutions that show unusual geographical patterns; scrutinizing traffic flows to identify extensive communications involving multiple IP addresses within brief intervals; formulating rapid flux detection methods; attempting to link phishing activities and similar threats to fast-flux techniques; and assisting clients in sharing information regarding defenses against fast-flux tactics.
However, ultimately, the advisory serves as an endorsement for Protective DNS (PDNS) service providers—companies offering security solutions that can assist in reducing the impact of fast flux attacks.
Michael Taggart, a cybersecurity analyst who shared this through Mastodon, highlighted that one key point from the CISA advisory is that companies should assert their DNS control by ensuring their resources utilize DNS servers they select themselves.
“If you have the ability to identify and block DNS queries within your network, fast flux becomes ineffective,” he stated.
In other words, you have the option to filter DNS requests for fast-flux domains so that their responses do not reach compromised devices, thereby triggering an alert. This approach works as long as you consistently track which domains are being utilized or if you can identify when clients are sending unusually suspect queries.