UNK_QuietRacket Google DoH resolution of malicious C2 domains

Ankit Mehta@Secvyn

•updated Sep 10, 2026•0•0•2

Detects specific DNS-over-HTTPS (DoH) requests made to Google resolvers containing suspicious domain patterns associated with potential C2 infrastructure (QuietRacket). This includes both the identification of the DoH API call for a specific TXT record and the preceding TLS session initiation to the DoH provider.