A DNS investigation into the Russia-aligned Earth Sirrush espionage campaign identifies potentially malicious domains, historical infrastructure connections and 95 IP addresses belonging to possible victims of attacks targeting Ukrainian government, defense and logistics organizations.