Chinese hackers use DNS-over-HTTPS for Linux malware communication.
ChamelGang and ChamelDoH: A DNS-over-HTTPS implant
https://stairwell.com/news/chamelgang-and-chameldoh-a-dns-over-https-implant/
https://www.bleepingcomputer.com/news/security/chinese-hackers-use-dns-over-https-for-linux-malware-communication/
https://t.me/cKure/12504