Nightmare Eclipse C2 Rotation: DoH Tunneling with High Distinct Destination Count

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential Command and Control (C2) infrastructure rotation and DNS exfiltration by correlating DNS-over-HTTPS (DoH) traffic to Google Public DNS (8.8.8.8) with concurrent outbound connections to a high count (>=5) of distinct external IP addresses within a one-hour window. This behavior is consistent with the Nightmare Eclipse/VerdantBamboo post-disclosure tactical shifts to obfuscate DNS queries and rotate C2 endpoints.