How the Saitama backdoor uses DNS tunnelling
blog.malwarebytes.com