DNSpionage

DNSpionage is the name used for a cyber-espionage campaign centered on DNS hijacking and abuse of third-party infrastructure to support follow-on intrusion activity. The operation is notable for compromising trusted infrastructure and DNS services to redirect victim traffic and facilitate credential collection, surveillance, and broader espionage objectives. It has been discussed alongside activity associated with OilRig, reflecting tradecraft overlap in the use of compromised infrastructure and DNS-related manipulation, but the supplied facts do not establish DNSpionage itself as a distinct, fully attributed threat actor with high confidence. The activity associated with DNSpionage demonstrates infrastructure-centric tradecraft rather than conventional malware branding alone. Relevant behaviors include compromising third-party servers, domains, network devices, and DNS services to stage and execute operations while blending malicious traffic with legitimate communications. Such operations can support phishing, proxying, information gathering, and initial access, particularly where trusted or high-reputation infrastructure is abused to reduce detection. The campaign is best characterized as espionage-oriented and reliant on defense evasion through infrastructure compromise and spoofed trust relationships.