Many enterprise networks show signs of malicious DNS activity

More than four fifths of recently tested enterprise networks have shown evidence of malicious DNS activity.

Those are the results of a new report by Infoblox, the network control company. It analysed 519 files capturing DNS traffic, from 235 customers in various verticals, during the first quarter of 2016. In 83 per cent of cases, ‘suspicious’ DNS activity was found.

The most common threats are botnets (54 per cent) and protocol anomalies (54 per cent), followed by DNS tunnelling (18 per cent), ZeuS malware (17 per cent) and Distributed denial of service (DDoS) traffic (15 per cent). Other threats include Cryptolocker ransomware, amplification and reflection traffic, and heartbleed.