DNS EXIT is a cybersecurity tool associated with threat actor BlueDelta, described in connection with a persistent campaign against UKR.NET.
DNS EXIT is a cybersecurity tool associated with threat actor BlueDelta, described in connection with a persistent campaign against UKR.NET. It appears to function as a DNS-based command-and-control and data-exfiltration mechanism, enabling stealthy, long-term presence by leveraging DNS tunneling techniques to evade traditional network defenses.
Between February and September 2025, BlueDelta, a Russian state-sponsored group, conducted multiple credential-harvesting campaigns. These operations targeted users of UKR.NET, a popular Ukrainian webmail and news…