Something I'm always interested in is how vulnerabilities/attacks are leveraged once a system is compromised. Obviously if an attacker controls DNS they could

Something I'm always interested in is how vulnerabilities/attacks are leveraged once a system is compromised. Obviously if an attacker controls DNS they could do all sorts of bad things: setup a phishing site that looks official, put up a fake press release announcing a merger or sale to manipulate the stock price, hold the domain hostage, etc. Most of those actions (while bad) would be detected pretty readily. What's clever here is that the attackers _maintain_ a working proxy back to the real system for an extended period of time. Time during which they can then inspect the traffic and peel out sensitive data, presumably to re-use those credentials to break into other systems and escalate further.