Snark in title courtesy of and credit to TheRegister : https://www.theregister.com/2025/04/03/cisa_and_annexable_allies_warn/
The US govt’s Cybersecurity Infrastructure Agency, aka CISA, on Thursday urged organizations, internet service providers, and security firms to strengthen defenses against so-called fast flux attacks. Fast flux refers to a technique for obscuring malicious servers by, rather simply, rapidly altering their Domain Name System (DNS) records. … “Malicious cyber actors, including cybercriminals and nation-state actors, use fast flux to obfuscate the locations of malicious servers by rapidly changing Domain Name System (DNS) records,” said CISA in its advisory [PDF]. “Additionally, they can create resilient, highly available command and control (C2) infrastructure, concealing their subsequent malicious operations.” … As described by MITRE, fast flux comes in two unpalatable flavors: Single flux and double flux. Single flux involves rapidly changing the DNS A record (or AAAA record for IPv6) which binds the domain name to an IP address. Double flux changes both the DNS A record and the authoritative nameserver for that record – the DNS NS record for the DNS zone file (the full set of DNS records for the domain). It may also involve changing the DNS CNAME (Canonical Name) record. … CISA et al in their report recommend a combination of detection and defense techniques, such as using threat intelligence feeds in association with boundary firewalls, DNS resolvers, and SIEM (Security Information and Event Management) services. …
Regards