A quirk in the SUNBURST DGA algorithm

This post details Cloudflare's analysis of the SUNBURST malware's Domain Generation Algorithm (DGA), uncovering a novel technique where hostnames are split across multiple DNS queries. Cloudflare identified how these fragmented queries are reassembled using XOR operations on their headers, revealing a previously unknown quirk in the malware's communication strategy. This analysis contributes to Cloudflare's ongoing efforts in threat intelligence and the development of advanced security measures to detect and neutralize sophisticated malware.