Decoding Greenbug Group's Command and Control Communications via DNS Tunneling

DomainTools used passive DNS data to show that Greenbug's ISMDoor malware was still actively using its DNS tunneling infrastructure as late as November 2019 — more than two years after the malware was first publicly documented. By searching for the unique, static IPv6 addresses that ISMDoor's C2 protocol always returns during session setup, DomainTools identified 19 C2 domains, then pivoted to uncover 37 more associated domains. The report maps the breadth of Greenbug's infrastructure and provides a repeatable method for defenders to hunt for new domains as Greenbug rotates them.

The infrastructure belongs to Greenbug, an Iranian-linked cyberespionage group active since at least 2016. The group is believed to be associated with Iranian state interests and has consistently targeted organizations in the Middle East. Despite years of public reporting on their tools and techniques, Greenbug continued operating ISMDoor with the same DNS tunneling approach through at least late 2019, showing little concern about being identified.

ISMDoor's DNS tunneling C2 is used for espionage — covertly issuing commands to compromised systems, stealing data, and maintaining persistent access. The DNS channel is deliberately chosen because most organizations do not monitor DNS traffic for anomalies, making it harder to detect than HTTP-based C2. The infrastructure DomainTools maps represents the backbone of Greenbug's long-running access operations against Middle Eastern targets.

DomainTools identified 19 C2 domains through passive DNS pivoting on ISMDoor's static fingerprints. Pivoting further from two of those domains uncovered an additional 37 associated domains. Most were sinkholed by December 2019, but at least two — winrepp[.]com and microsoft-publisher[.]com — were confirmed as recently active or live. The full domain list in this report's IOC bundle covers the complete known set across multiple years of Greenbug infrastructure activity.

The IOC overlap data shows that several ISMDoor C2 domains appear in infrastructure tracked across multiple Iranian-linked threat actor reports — including OilRig, APT33, and the xHunt campaign targeting Kuwait. This suggests either shared infrastructure registration practices, overlapping operations, or deliberate reuse of C2 hosting across different Iranian-aligned groups. It is a useful pivot point for defenders tracking multiple threat actors in the region.

ISMDoor communicates entirely through DNS. Infected machines generate a unique session ID and send it to the C2 domain as part of a DNS query. The C2 nameserver responds with a static IPv6 address to acknowledge the session. Messages and data are encoded in DNS query subdomains, and responses are carried back as IPv6 addresses — sometimes static acknowledgments, sometimes addresses where specific bytes encode message counts or content. This cycle repeats for each command and each data transfer, keeping all traffic inside normal-looking DNS resolution.

Greenbug registers domains designed to look like legitimate software and network services — names like ntpupdateserver[.]com, adobeproduct[.]com, microsoft-publisher[.]com, and winappupdater[.]com. This makes the C2 domains blend in with normal enterprise traffic at the domain name level. Combined with the DNS-only communication channel, the infrastructure is designed to avoid detection in environments that do not perform deep DNS inspection.