Based on the article I think this malware hijacks the DNS resolver of an infected machine, so that it will point to these rogue DNS servers and return bullshit

Based on the article I think this malware hijacks the DNS resolver of an infected machine, so that it will point to these rogue DNS servers and return bullshit results. An affected organization would be completely out of the loop.