DeviceManager RAT DNS C2 to 91.92.240.100 with malformed structure or o-/e-/r- prefixed queries

Duo Tech@duotech

•updated Aug 13, 2026•0•0•1

Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.