PLASMAGRID DGA Traffic

Elgonad .@elgonad

•updated Mar 4, 2026•2•0•58

Detects DNS queries for domains that match the pattern used by the PLASMAGRID malware's Domain Generation Algorithm (DGA). This malware, delivered by the Coruna iOS exploit kit, uses a DGA seeded with "lazarus" to generate 15-character domains with a ".xyz" TLD for command and control fallback.