A new wave of DNS Hijacking campaign targeting various domains organizations belonging to various government, telecommunications and internet infrastructure entities.
The campaign has targeted victims across the globe at an unprecedented scale at a high degree of success rate. Security researchers from FireEye tracked the activity for several months and the attackers explotiting it with high degree of success.
DNS hijacking is a type of Malicious attack that used to redirect the users to the malicious website when they visit the website via compromised routers or attackers modifying a server’s settings.
According to researchers the campaign is active from January 2017 to January 2019 and the attack not carried out by a single actor based on the timeframes, infrastructure, and service providers.
“Technical evidence shows that attack carried out by threat actors in Iran and the entities targeted and the activity aligns with Iranian government interests.”
DNS Hijacking Campaign
Threat actors followed multiple techniques to manipulate the DNS records.
With the first method attackers log in with the DNS provider’s administration panel and attackers points the A record IP of the domain top a different IP address. Then attackers uses Let’s Encrypt certificate to establish a secure connection without any certificate errors.
In the second method attackers gained access to the server and they will change the nameserver details and implement proxies to listen all the ports.
Third technique involves DNS Redirector which responds to DNS requests, with the previously modified A and NS records to redirect victim’s traffic to the servers controlled by attackers.
Researchers said a number of the organization affected with the patterns of DNS record manipulations and fraudulent SSL certificates.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
