H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

DnsSystem

[DnsSystem](https://attack.mitre.org/software/S1021) is a .NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2022.(Citation: Zscaler Lyceum DnsSystem June 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[DnsSystem](https://attack.mitre.org/software/S1021) is a .NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2022.(Citation: Zscaler Lyceum DnsSystem June 2022)

Labels

malware
10 recorded

Relationships

uses
to Data from Local System
Technique
uses
to DNS
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Malicious File
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Standard Encoding
Technique
uses
to System Owner/User Discovery
Technique
uses
to Windows Command Shell
Technique
uses
from HEXANE
Group
2 external

References

mitre-attack
S1021
open
Zscaler Lyceum DnsSystem June 2022
https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance