Threat actors found distributing malware via DNS