Topic starter
11/11/2026 6:00 pm
TL;DR: ErrTraffic keeps replacing malicious infrastructure fast enough to outpace blocklists, leaving defenders dependent on controls that can still see the campaign at the delivery and execution stages, according to WatchGuard. MSPs need layered detection because address-based blocking no longer covers the whole infection chain.
Editorial analysis by NHI Mgmt Group, based on content published by WatchGuard: “How to Stop a Malware Campaign That Can Shift Its Infrastructure”.
Key questions
Q: Why do static domain blocklists fail against rotating malware infrastructure?
A: Static domain blocklists fail because rotating malware infrastructure changes domains, IP addresses, or hosting providers faster than defenders can update detections.
Q: How does EtherHiding support malware delivery?
A: EtherHiding is a malware delivery technique that stores payloads or downloader logic in blockchain smart contracts or related decentralised infrastructure.
Q: How do I detect malicious PowerShell launched through fake repair prompts?
A: Look for users copying and pasting commands into Run, terminal or browser-based prompt flows, then correlate that activity with unusual PowerShell child processes, network fetches and process trees that do not match normal admin behaviour.
Practitioner guidance
- Harden script execution controls Block or constrain high-risk script launch paths such as copied PowerShell commands from user-facing prompts and monitor for suspicious command-line activity.
- Correlate network and endpoint telemetry Use host process lineage alongside DNS, proxy and web logs so a changed host name does not erase the observable chain of execution.
- Treat blocklists as temporary containment Assume domains, IPs and download hosts can be replaced quickly and make sure alerts escalate to behaviour-based detections and isolation actions.
Bottom line: ErrTraffic shows how malware campaigns can survive rapid infrastructure swaps without changing their underlying infection chain.
Glossary terms: ErrTraffic, ClickFix, EtherHiding, Blocklist
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Static infrastructure blocking is no longer a complete malware containment model. ErrTraffic shows that blocklists still matter, but only as one layer in a larger control stack. When attackers can swap hosts and update delivery points without changing the broader infection chain, the defender's real problem is continuity of malicious function, not the lifespan of a single bad address. Practitioners should treat reputation controls as a short window of suppression, not as a durable stop condition.
A question worth separating out:
Q: What should MSPs do first when a malware campaign keeps changing hosts?
A: MSPs should first map the campaign’s infrastructure patterns, then move to layered detection across DNS, proxy, endpoint, and email telemetry so repeated host changes do not break coverage. Baselines for command-and-control behaviour, certificate reuse, and redirect chains help identify the campaign even when IPs and domains rotate. Centralised threat hunting and rapid block, isolate, and sinkhole actions should follow.
👉 Read our full editorial: ErrTraffic uses decentralized updates to outpace static blocking