DeviceManager DNS tunneling correlated with prior blockchain eth_call RPC

Duo Tech@duotech

•updated Aug 4, 2026•2•0•2

Detects DeviceManager DNS TXT/A tunneling traffic occurring within 60 seconds after an eth_call blockchain RPC request from the same host, consistent with DeviceManager resolving C2 via EtherHiding before tunneling.