Anyone else following Storm-2603? DNS C2 in recent LockBit/Warlock attacks—does this signal new APT-ransomware overlap?

Just caught this in the news: Apparently Storm-2603 (the usual China-attributed crew) is now dropping both Warlock and LockBit ransomware, but what really caught my eye was their DNS-controlled C2/backdoor.

What’s weird is how “APT-like” the whole setup is - DNS TXT channels, dynamic session IDs, DLL sideloading - and yet this time it’s delivering mainstream ransomware, not just espionage stuff.

A couple of thoughts that I can’t shake:

• How common is real-world DNS C2 traffic that doesn’t set off blue team alarm bells? Anyone seen this style (63-byte DNS subsegmenting, XOR/hex responses) pop up in your environments?
• Not sure if this is just infrastructure reuse or a real blending of APT + ransomware operations. What’s everyone else seeing - just noise, or real escalation?
• For those with detection stories (successes or failures), did you catch anything like this recently? What helped, what didn’t?

Just trying to work out if this is the future for bigger ransomware ops or just a one-off case that’ll get patched away.

Curious to hear what others in the community think - especially blue team and threat intel folks!