Operation GhostMail DNS Exfiltration

Elgonad .@elgonad

•updated Mar 20, 2026•1•0•25

Detects DNS resolution requests to the Operation GhostMail exfiltration subdomains (*.i.zimbrasoft.com.ua) and main domain. DNS exfiltration is the primary channel used by this APT to steal credentials and 2FA codes even when HTTPS is blocked.