TINYSHELL backdoors that used dynamic DNS domains for their external command and control channel. These domains were created perhost and were not used more than once, the subdomains sometimes resembled the hostname of the compromised machine. Mandiant was