DNS Hijacking Campaign Targeting Various Organizations Around the Globe

A new wave of DNS Hijacking campaign targeting various domains organizations belonging to various government, telecommunications and internet infrastructure entities.

The campaign has targeted victims across the globe at an unprecedented scale at a high degree of success rate. Security researchers from FireEye tracked the activity for several months and the attackers explotiting it with high degree of success.

DNS hijacking is a type of Malicious attack that used to redirect the users to the malicious website when they visit the website via compromised routers or attackers modifying a server’s settings.

According to researchers the campaign is active from January 2017 to January 2019 and the attack not carried out by a single actor based on the timeframes, infrastructure, and service providers.

“Technical evidence shows that attack carried out by threat actors in Iran and the entities targeted and the activity aligns with Iranian government interests.”

DNS Hijacking Campaign

Threat actors followed multiple techniques to manipulate the DNS records.

With the first method attackers log in with the DNS provider’s administration panel and attackers points the A record IP of the domain top a different IP address. Then attackers uses Let’s Encrypt certificate to establish a secure connection without any certificate errors.

In the second method attackers gained access to the server and they will change the nameserver details and implement proxies to listen all the ports.

Third technique involves DNS Redirector which responds to DNS requests, with the previously modified A and NS records to redirect victim’s traffic to the servers controlled by attackers.

Researchers said a number of the organization affected with the patterns of DNS record manipulations and fraudulent SSL certificates.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Cloudflare Announced Internet’s Fastest DNS Service 1.1.1.1 that Extremely Focus on Consumer Privacy

New Phishing Attack Taking Advantages of Vulnerability in Office 365 to Bypass all of Microsoft’s Security

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago