The issue allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. This occurs because the resolver in ISC BIND 9 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query. The estimated number of potentially affected devices is not specified. However, the issue has been leveraged for DNS tunneling in various campaigns, including those by Darkhydrus, Oilrig, and Cobalt katana, targeting educational institutions, network infrastructure, and cloud environments across APAC, America, EMEA, and Japan.