Gamaredon - Check-Hosts.net DNS Resolution

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects the Gamaredon implant executing DNS resolution checks through the public proxy utility check-host.net to map active fast flux IPs. This activity is initiated by wscript.exe or mshta.exe.